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The  Purposes  of  the  Freedom 
of  Information  and  Protection 
of  Privacy  Act 

The  purposes  of  the  Freedom  of  Information  and  Protection 
of  Privacy  Act  according  to  Section  2 of  the  Act  are: 

a)  to  allow  any  person  a right  of  access  to  the  records 
in  the  custody  or  under  the  control  of  a public  body, 
subject  to  limited  and  specific  exceptions  as  set  out  in 
the  Act, 

b)  to  control  the  manner  in  which  a public  body  may 
collect  personal  information  from  individuals,  to 
control  the  use  that  a public  body  may  make  of  that 
information  and  to  control  the  disclosure  by  a public 
body  of  that  information, 

c)  to  allow  individuals,  subject  to  limited  and  specific 
exceptions  as  set  out  in  the  Act,  a right  of  access  to 
personal  information  about  themselves  that  is  held  by 
a public  body, 

d)  to  allow  individuals  a right  to  request  corrections  to 
personal  information  about  themselves  that  is  held  by 
a public  body,  and 

e)  to  provide  for  independent  reviews  of  decisions  made 
by  public  bodies  under  this  Act  and  the  resolution  of 
complaints  under  this  Act. 

The  Purposes  of  the  Health 
Information  Act 

The  purposes  of  the  Health  Information  Act  according  to 
Section  2 of  the  Act  are: 

a)  to  establish  strong  and  effective  mechanisms  to  protect 
the  privacy  of  individuals  with  respect  to  their  health 
information  and  to  protect  the  confidentiality  of  that 
information, 

b)  to  enable  health  information  to  be  shared  and  accessed, 
where  appropriate,  to  provide  health  services  and  to 
manage  the  health  system, 


c)  to  prescribe  rules  for  the  collection,  use  and  disclosure 
of  health  information,  which  are  to  be  carried  out  in 
the  most  limited  manner  and  with  the  highest  degree  of 
anonymity  that  is  possible  in  the  circumstances, 

d)  to  provide  individuals  with  a right  of  access  to  health 
information  about  themselves,  subject  to  limited  and 
specific  exceptions  as  set  out  in  this  Act, 

e)  to  provide  individuals  with  a right  to  request  correction 
or  amendment  of  health  information  about  themselves, 

f)  to  establish  strong  and  effective  remedies  for 
contraventions  of  this  Act,  and 

g)  to  provide  for  independent  reviews  of  decisions  made 
by  custodians  under  this  Act  and  the  resolution  of 
complaints  under  this  Act. 

The  Purposes  of  the  Personal 
Information  Protection  Act 

The  purposes  of  the  Personal  Information  Protection  Act 

according  to  section  3 of  the  Act  is: 

...to  govern  the  collection,  use  and  disclosure  of 
personal  information  by  organizations  in  a manner 
that  recognizes  both  the  right  of  an  individual  to  have 
his  or  her  personal  information  protected  and  the  need 
of  organizations  to  collect,  use  or  disclose  personal 
information  for  purposes  that  are  reasonable. 


Copies  of  this  report  are  available  from: 

Office  of  the  Information  and  Privacy  Commissioner 
410,  9925  - 109  Street,  Edmonton,  Alberta  T5K  2J8 
Tel:  (780)  422-6860  Fax:  (780)  422-5682 
Website:  www.oipc.ab.ca  E-mail:  generalinfo@oipc.ab.ca 
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■ COMMISSIONER’S  MESSAGE 


Privacy  Compliance 
in  the  Private  Sector? 

Or.. .Living  with  PIPA: 

The  Private  Sector  Experience? 

The  Personal  Information  Protection  Act  came  into 
force  on  January  1,  2004.  A year  and  a half  later, 
this  legislation  is  seen  to  be  manageable,  reasonable 
and  workable  in  the  private  sector.  In  some  cases,  the 
existence  of  this  law  is  paying  significant  dividends  for 
Albertans. 

The  statistics  we  have  kept  since  the  Act  came  into  force 
tell  us  that  stakeholders  are  feeling  the  effect  of  the  law: 

• 3973  queries 

• 119  presentations 

• 698  reviews/complaints  opened 

• 342  reviews/complaints  closed 

• 10  Investigation  Reports  published 

• 13  inquiries  scheduled 


In  this  reporting  period,  most  of  the  complaints  from  the 
public  have  been  resolved  on  the  basis  of  Investigation 
Reports  and  mediated  settlements  by  this  Office.  An 
Investigation  Report  is  done  when  this  Office  gets 
a complaint  and  one  of  our  Portfolio  Officers  goes 
out,  determines  the  facts  and  writes  a report  making 
recommendations  to  the  parties.  If  the  complainant  and 
the  organization  agree  to  the  report,  it  gets  signed  off  and 
the  matter  is  concluded  on  the  basis  of  the  Investigation 
Report.  If  there  is  no  agreement,  then,  as  Commissioner,  I 
hold  an  inquiiy  and  issue  an  order. 

Many  of  the  issues  that  have  arisen  have  been  systemic 
issues  that  reflect  the  conflicts  that  develop  for  us  as  a 
society.  Many  of  these  problems  occur  as  a result  of  the 
application  of  technology  to  aspects  of  our  lives: 

• Video  surveillance 

• Consumer  profiling 

• Challenges  of  safeguarding  personal  information 

• Pre-employment  screening  and  other  workplace 
privacy  issues 

We  have  seen  a number  of  significant  issues  under  the  Act 
resolved  on  the  basis  of  published  Investigation  Reports. 
The  Investigation  Reports  on  Linens  ‘N  Things,  Nordon 
Collection  Network  and  Digital  Communications  Group 
addressed  the  failure  to  safeguard  personal  information; 
Hoffman  Holdings  concerned  video  surveillance  in  the 
workplace;  and  EPCOR  and  ATCQ/Direct  Energy  pertained 
to  consumer  profiling  and  customer  authentication. 
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What  this  suggests  to  me  is  that  the  private  sector  is 
getting  on  side  with  this  legislation;  this  sector  has  in 
some  cases  exceeded  expectations  in  adopting  the  new 
rules.  What  this  also  suggests  to  me  is  that  this  Office 
is  bringing  forward  reasonable  applications  of  the  law; 
applications  which  both  complainants  and  organizations 
find  acceptable.  This  is  not  to  say  that  because  a matter 
has  to  go  to  inquiiy,  someone  is  not  onside:  there  are 
some  very  complex  issues  here  that  will  no  doubt  require 
full  hearings  to  determine  a reasonable  outcome. 

The  issues  we  have  been  faced  with  and  the  outstanding 
work  done  on  the  cases  by  the  people  who  work  in 
this  Office  have  resulted  in  excellent  media  coverage 
in  Alberta  and  nationally.  This  is  not  a matter  of 
aggrandizement  for  this  Office:  the  issues  we  are 
confronted  with  are  not  unique  to  Alberta.  These  are 
national  issues  and  if  we  are  able  to  inform,  enlighten  or 
even  simply  notify  others  of  these  issues,  it  is  value  added. 
We  have  been  very  fortunate  in  this  regard  in  having 
good,  cooperative  relationships  with  the  other  Information 
and  Privacy  Commissioners  in  Canada,  in  particular  with 
the  Privacy  Commissioner  of  Canada  and  the  Information 
and  Privacy  Commissioner  of  British  Columbia. 

Perhaps  the  most  startling  revelation  for  me  was  the 
connection  between  poor  information  management 
practices  in  the  private  sector,  identity  theft  and  fraud 
and  the  drug  trade.  Sometimes  you  have  to  be  lucky 
to  be  good  and  when,  in  November  of  2004,  I saw  an 
announcement  by  the  Edmonton  Police  Service  that  they 
had  found  large  amounts  of  “commercial  paper”  in  an 
alleged  drug  den,  I wanted  to  know  how  it  got  there. 


The  EPS  detectives  were  very  helpful  and  we  realized 
that  the  Personal  Information  Protection  Act  could  be 
a significant  tool  in  combating  identity  theft  and  fraud 
- an  unexpected  pay-off  of  the  legislation.  Not  only  does 
identity  theft  and  fraud  have  a significant  monetary  cost 
for  individuals  and  society,  but  also  a social  cost  in  that 
the  money  gained  by  this  kind  of  fraud  goes  to  fuel  the 
drug  trade,  ciystal  meth  in  particular. 

I am  not  naive:  I know  there  are  some  very  difficult  issues 
in  this  area  that  have  not  yet  been  dealt  with:  drug  and 
alcohol  testing  and  surveillance  in  the  workplace  come  to 
mind.  I also  know  that  compliance  is  neither  uniform  nor 
perfect  throughout  the  province.  I fully  expect  that  some 
of  these  issues  will,  quite  rightly,  necessitate  inquiries  and 
that  is  the  role  of  this  Office.  Notwithstanding  that, 
we  have  made  good  progress  in  Alberta  with  respect 
to  the  protection  of  personal  information  in  the  private 
sector.  The  Personal  Information  Protection  Act  is 
making  a difference. 
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■ INTRODUCTION 


Background 

The  Alberta  Freedom  of  Information  and  Protection  of 
Privacy  (FOIP)  Act  received  Royal  Assent  on  June  1, 

1994,  although  most  of  the  Act  did  not  come  into  force 
until  October  1,  1995.  The  Health  Information  Act  (HIA) 
was  passed  by  the  Alberta  Legislature  in  1999  and  came 
into  force  on  April  25,  2001.  The  Personal  Information 
Protection  Act  (PIPA)  was  passed  by  the  Alberta 
Legislature  in  2003  and  came  into  force  on  January 
1,  2004.  Franklin  J.  Work,  Q.C.,  was  appointed  as  the 
province’s  second  Information  and  Privacy  Commissioner 
in  2002. 

Mandate 

Under  the  Acts,  the  Commissioner  is  responsible  for 
performing  a broad  range  of  functions.  Section  53  of  the 
FOIP  Act,  Section  84  of  the  HIA,  and  Section  53  of  the 
PIPA  set  out  a number  of  these  responsibilities: 

• Informing  Albertans  about  the  FOIP  Act,  the  HIA,  and 
the  PIPA. 

• Reviewing  the  access  to  information  decisions  of  public 
bodies  under  the  FOIP  Act. 

• Reviewing  the  access  to  information  decisions  of 
custodians  under  the  HLA. 

• Reviewing  the  access  to  information  decisions  of 
organizations  under  the  PIPA. 

• Investigating  how  public  bodies,  custodians  and 
organizations  collect,  use  and  disclose  personal  and 
health  information  to  make  sure  that  an  individual’s 
privacy  is  being  protected. 


• Conducting  investigations  of  public  bodies  to  ensure 
compliance  with  the  FOIP  Act. 

• Conducting  investigations  of  custodians  to  ensure 
compliance  with  the  HLA. 

• Conducting  investigations  of  organizations  to  ensure 
compliance  with  the  PIPA. 

• Hearing  comments  from  the  public  about  how  the  Acts 
are  being  administered. 

• Researching  anything  affecting  the  achievement  of  the 
FOIP  Act,  the  HIA  and  the  PIPA’s  purposes. 

• Commenting  on  the  privacy  and  information 
implications  of  proposed  legislation  and  programs. 

• Informing  the  heads  of  public  bodies,  custodians, 
and  organizations  when  applicants  have  not  been 
adequately  served  under  the  Acts. 

• Giving  advice  and  recommendations  about  the  Acts  to 
heads  of  public  bodies,  custodians,  and  organizations. 

• Authorizing  the  collection  of  personal  information 
from  sources  other  than  the  individual  the  information 
is  about. 
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■ ORGANIZATIONAL  STRUCTURE  04-05 


COMMISSIONER 


nlWrc  nlW  WPl  llwl 


Human  Resources 
& Finance* 


Legal* 


Information 

Technology* 


HIATeam*  FOlPTeam* 


PIPATeam* 

[Calgary] 


*Each  Team  is  led  by  a Director 


Research  & 
Issues  Manager 


Director, 
Policy  & 
Consultation 


Admin 

Assistant 
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■ EDUCATION  AND  PUBLIC  RELATIONS 


Under  Section  53  of  the  FOIP  Act,  Section  84  of  the  HLA, 
and  Section  36  of  the  PIPA,  one  of  the  Commissioner’s 
responsibilities  is  to  inform  the  public  about  the  Acts,  as 
well  as  to  receive  comments  from  the  public  concerning  the 
administration  of  the  Acts.  This  is  an  important  function  to 
help  Albertans  understand  their  access  and  privacy  rights. 

Many  organizations  or  groups  are  looking  for  basic 
explanations  and  descriptions  of  the  Acts  and  the  function 
of  the  Office  of  the  Information  and  Privacy  Commissioner 
(OIPC).  Other  times,  groups  have  specific  questions  or 
concerns  with  regard  to  the  effect  the  Acts  have,  or  will 
have,  on  information  management  relative  to  specific 
areas.  The  OIPC  is  open  to  helping  Albertans  interpret  the 
Acts  and  to  understand  issues  surrounding  access  to  or 
privacy  of  information. 

The  following  are  some  of  the  educational 
initiatives  undertaken  by  the  OIPC  over  the 
past  year: 

• HLA  overview  for  Bow  Valley  College,  Calgaiy 

• HIA  ft  Research  Ethics 

• Researcher’s  role  vis-a-vis  HIA  disclosure  for  research 

• Privacy  presentation  to  St.  Francis  Xavier  High  School, 
Edmonton 

• FOIP/PIPA/HLA  presentation  to  HR  students  at 
University  of  Alberta,  Edmonton 

• FOIP/PIPA/HIA  presentation  to  HR  students  at  Grant 
MacEwan  College,  Edmonton 

Some  of  the  Conferences  and  presentations 
OIPC  addressed  over  the  past  year: 

• Alberta  Health  Records  Association  Conference, 
Edmonton 

• Canadian  Institute  for  Health  Information  Partnership 
Conference,  Calgary 


University  of  Alberta  Access  and  Privacy  Conference, 
Edmonton 

Health  Information  Protection  Act  Conference,  Regina 
Electronic  Health  Records  Conference,  Vancouver 
Investigators’  Conference,  Regina 

Canadian  Bar  Association  Administrative  Law  Section, 
Privacy  Update  and  Privacy  Law  Essentials  for  the 
Administrative  Law  Lawyer,  Edmonton 

FOIP  Considerations  in  Staffing  workshop  at  the 
Personnel  Administration  Office,  Edmonton 

FOIP  and  Human  Resources  presentation  at  Sustainable 
Resource  Development,  Edmonton 

HLA  - An  Overview  presented  to  the  AB  Podiatiy 
Association,  Edmonton 

Consistent  Application  of  HLA  Severing  Principles 

- Capital  Health,  Edmonton 

Consistent  Application  of  HLA  Severing  Principles 

- Aspen  Health,  Westlock 

FOIP,  PIPA  and  HIA  presentation  at  the  Society  for 
Retired  and  Semi-Retired,  Edmonton 

PLA  for  Local  Primary  Care  Initiative  Office  H AHW, 
Edmonton 

PIPA  presentation  to  the  Petroleum  Services 
Association  of  Canada,  Red  Deer 

PIPA  presentation  to  the  Independent  Financial  Brokers 
Summit  Meeting  in  Calgary 

Presentation  on  private  sector  privacy  to  the 
Hospitality,  Financial  8t  Technology  Professionals, 
Southern  Alberta  Chapter  in  Banff 

PIPA  presentation  to  the  Canadian  Condominium 
Institute,  Edmonton 

PIPA  presentation  to  the  Insurance  Institute  of 
Southern  Alberta,  Calgary 


[8] 


Office  of  the  Information  and  Privacy  Commissioner 


2004/200! 


Private  sector  privacy  presentation  to  the  IBEW  Plan 
Members,  Edmonton 

PIPA  presentation  to  the  Institute  of  Professional 
Accountants,  Banff 

Private  sector  privacy  presentation  to  the  Canadian  Bar 
Association  Sub-Section,  Edmonton 

Privacy  Officers  Forum  PIPA  presentation,  Calgary 

Practical  Tips  for  Handling  Health  Information  - 
Treaty  8,  Edmonton 

HIA  presentation  to  Health  Care  Providers,  Edmonton 
PIPA  presentation  to  Business  Link,  Edmonton 

PIPA  presentation  to  Anderson  Career  Training 
Institute,  Edmonton 

HLA/FOIP  Presentation  to  Churchill  Retirement 
Community,  Edmonton 

PIPA  presentation  to  Crossroads  C 8t  I (Wholesale 
Distribution  Company),  Edmonton 

HIA  presentation  to  University  of  Calgary  Medical 
Clinics,  Calgary 

HIA  presentation  to  Neurosurgical  Associates, 
Edmonton 

Physician  Office  System  Program  Spring/Fall  2004 
Change  Management  Workshops  (Grande  Prairie, 
Edmonton,  Red  Deer,  Calgary,  Edson,  Lethbridge, 
Medicine  Hat) 

HIA  research  presentation  to  Tom  Baker  Cancer  Centre, 
Calgary 

FOIP  presentation  to  Alberta  College  of  Social  Workers, 
Edmonton 

ARMA  Canadian  National  Conference  2004  - Health 
Information  Management  vis-a-vis  Privacy  Legislation, 
Vancouver 

College  of  Physicians  and  Surgeons  Annual  Research 
Symposium,  Edmonton 


• Private  sector  privacy  presentation  made  to  the 
Workplace  Privacy  Conference,  Vancouver,  BC 

• PIPA  presentation  to  Nymity  Inc.,  Toronto 

• PIPA  presentation  to  the  Institute  of  Internal  Auditors 
Western  Regional  Conference,  Edmonton 

• Insight  Conference,  privacy  sector  privacy  presentation, 
Edmonton 

• PIPA  presentation  to  the  Alberta  Health  ft  Safety 
Conference,  Edmonton 

• Rural  Electrification  Association,  PIPA  presentation, 
Edmonton 

Some  External  Committees  the  OIPC  staff  are 
involved  with: 

• Government  of  Alberta  Cross-Ministry  ID  Theft 
Initiative  (Solicitor  General  and  Alberta  Government 
Services,  Co-Chairs) 

• Outsource  Agreements  Project  Committee  (Alberta 
Government  Services  and  the  OIPC,  Co-Chairs) 

• Provincial  FOIP  Coordinators’  Forum  (Alberta 
Government  Services,  Chair) 

• Provincial  Fraud  Awareness  Month  (Edmonton  Police 
Service,  Chair) 

• Human  Resource  Directors’  Council  (Cross  Government 
of  Alberta  Committee) 

• Organizing  Committee,  U of  A’s  Access  and  Privacy 
Conference 

• POSP  Vendor  Conformance  and  Usability  Requirements 
(VCUR)  2006  Technical,  Privacy  and  Security  Working 
Group 

• U of  A,  Access  and  Privacy  2005  Planning  Committee 
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■ THE  PROCESS:  REQUEST  FOR  REVIEW  AND  INQUIRY 


Applicant's  Request 
for  Review 


• •/A 


Office  of  the  Information 
and  Privacy  Commissioner** 


Officer  Assigned  to  Case/Confirms 
Request  for  Review  Sent  to  Parties 


Investigation 
and  Mediation 


Mediation  Successful 


Agreement  between  Applicant  and 
Public  Body,  Custodian,  or  Organization 


* Applicant:  a person  who  makes  a request  for  information 
held  by  a public  body,  custodian  or  organization  or  a 
person  who  is  affected  by  a public  body’s,  custodian’s  or 
organization’s  collection,  use  or  disclosure  of  that  information. 


JSllx 

Mediation  Not  Successful 


Commissioner's/Adjudicator's  Inquiry 


Commissioner's/Adjudicator's  Order 
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**  The  Commissioner/ Adjudicator  is  not  involved  with  the 
Request  for  Review  until  the  Inquiry  stage 
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■ MEDIATION  AND  INVESTIGATION 


The  role  of  the  Information  and  Privacy  Commissioner  is 
regulatory.  The  Commissioner’s  authority  to  mediate  and 
investigate  is  extensive. 

The  processes  involved  in  mediation  and  investigation 
within  the  OIPC  are  separate  and  distinct.  Mediation  is 
used  to  describe  the  activities  involved  in  the  review  of  an 
access  request.  Investigation  is  used  to  describe  the  activities 
involved  in  the  resolution  of  complaints. 

Mediation 

Should  an  individual  not  be  satisfied  with  the  decisions  made  by 
the  public  body/custodian/organization  in  response  to  a request 
for  access  to  information,  the  individual  may  approach  the 
Commissioner  and  ask  for  a review  to  be  conducted.  The  request 
for  a review  must  be  received  by  the  Commissioner’s  Office  no 
later  than  60  days  from  receipt  of  the  public  body/custodian’s 
response  (section  47(2) (a)  of  the  PIPA  requires  that  the  request 
be  delivered  within  30  days  of  the  individual  being  notified  of 
the  organization’s  decision).  Section  66(2)(ii)  of  the  FOIP  Act 
and  section  74(2) (b)of  the  HIA  allow  the  Commissioner  to  accept 
a request  for  review  after  the  60-day  period  if  he  so  decides 
(section  47(2)(b)  of  the  PIPA  authorizes  the  Commissioner  to 
allow  a longer  period).  Upon  receipt  of  a request  for  review,  the 
Commissioner  assigns  a Portfolio  Officer  to  mediate.  The  FOIP 
and  Health  Information  Acts  allow  90  days  for  the  purpose  of 
mediation  or  any  longer  period  authorized  by  the  Commissioner. 
The  PIPA  does  not  impose  a time  limit. 

During  mediation,  the  Portfolio  Officer  acts  as  a facilitator 
between  the  public  body/custodian/organization  and  the 
applicant  with  the  goal  of  negotiating  a mutually  acceptable 
resolution  of  the  dispute.  Mediation  involves  extensive  review 
of  the  records  at  issue,  the  interpretation  and  application 
of  various  pieces  of  complex  legislation,  identification  of 
concrete  issues  and  the  presentation  of  findings  to  the  parties. 
Mediation  is  extremely  effective  in  resolving  disputes  (see 
Table  4,  page  17)  over  access  to  records  and/or  the  duty 
imposed  by  Section  10  of  the  FOIP  Act  and  Section  10  of  the 
HIA  (section  27  in  the  PIPA  is  the  equivalent  “Duty  to  Assist” 
provision),  as  can  be  seen  in  the  statistics  that  follow  this 
discussion.  On  occasion  where  a resolution  cannot  be  reached, 
mediation  has  assisted  in  reducing  the  number  of  issues  that 
proceed  to  inquiry. 
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Investigation 

Complaints  result  when  a public  body/custodian/organization 
appears  to  be  contravening  the  privacy  provisions  outlined 
in  the  FOIP  Act,  the  HIA  and  the  PIPA.  They  usually  involve 
the  alleged  unauthorized  collection,  use  and  disclosure  of 
personal  information/health  information  by  a public  body/ 
custodian/organization.  Upon  receipt  of  a privacy  complaint, 
the  Commissioner  assigns  a Portfolio  Officer  to  investigate 
the  matter.  Unlike  mediation,  there  is  no  set  90-day  time 
period  for  the  completion  of  an  investigation. 

During  the  investigation,  the  Portfolio  Officer  endeavours  to 
piece  together  the  events  that  led  to  the  alleged  breach  and 
determine  whether  or  not  the  collection,  use  or  disclosure 
of  personal  information/health  information  was  indeed 
a contravention  of  the  FOIP  Act,  the  HIA  or  the  PIPA. 

An  investigation  may  involve  extensive  interviews  with 
parties  and  interpretation  and  application  of  legislation. 

The  findings  and  recommendations  of  an  investigation  are 
provided  to  the  parties  involved  and  may  be  presented  in  a 
formal  investigation  report  that  may  be  publicly  released.  The 
findings  and  recommendations  of  an  investigation  may  have 
far  reaching  implications. 

Inquiry 

If  no  resolution  is  reached  during  mediation,  an  individual 
may  ask  that  the  matter  proceed  to  inquiry.  Complainants 
may  ask  for  an  inquiry  if  they  are  not  satisfied  with  the 
findings  of  the  Portfolio  Officer’s  investigation  and  if  the 
complaint  relates  to  their  own  personal  or  health  information 
(the  PIPA  does  not  explicitly  say  that  a complaint  has  to  be 
about  an  individual’s  own  information).  A Commissioner’s 
inquiiy  is  a formal  quasi-judicial  process  where  the 
Commissioner  decides  issues  of  fact  and  law  to  resolve  a 
review  or  a complaint  and  issues  an  Order.  An  Order  issued 
by  the  Commissioner  is  final  and  the  only  avenue  of  appeal  is 
Judicial  Review  before  the  Court  of  Queen’s  Bench. 
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Office  of  the  Information  and  Privacy  Commissioner 

■ OIPC  STATISTICS:  2004-2005 


TABLE  1 : Cases  Opened  2004-2005  Fiscal  Year  FOIP,  HIA,  PIPA 


Statistics  are  from  the  period  April  1 , 2004  to  March  31 , 2005 


Case  Type 

FOIP 

HIA 

PIPA 

AMVIR 

Request  for  Review 

162 

40 

54 

7 

Excuse  Fees 

7 

0 

0 

0 

Complaint 

65 

22 

128 

0 

Privacy  Impact  Assessments  (PIA) 

13 

217 

0 

0 

Advice  and  Direction 

3 

1 

0 

0 

**Time  Extension 

25 

0 

0 

0 

Investigation  Generated  by  Commissioner 

4 

19 

6 

0 

Authorization  to  Disregard  a Request 

3 

3 

0 

0 

*Other 

22 

12 

0 

0 

TOTAL 

304 

314 

188 

7 

AMVIR  Statistics  are  from  the  time  period  the  Legislation  came  into  force  May  12,  2004  to  March  31, 2005. 

*Case  types  identified  in  the  "Other" category  include:  Requests  for  Information,  Comments  on  Schemes  and  Programs,  Research  Proposal  Agreements, 
Data  Sharing  Agreements  and  Non-jurisdictional. 

Please  refer  to  Appendix  A for  a complete  listing  of  the  cases  opened  in  the  2004-2005  fiscal  year 


TABLE  2:  Cases  Closed  2004-2005  Fiscal  Year  FOIP,  HIA,  PIPA 


Statistics  are  from  the  period  April  1 , 2004  to  March  3 1 , 2005 


Case  Type 

FOIP 

HIA 

PIPA 

AMVIR 

Request  for  Review 

144 

35 

35 

1 

Excuse  Fees 

11 

0 

0 

0 

Complaint 

46 

13 

69 

0 

**Privacy  Impact  Assessments  (PIA) 

11 

214 

0 

0 

Advice  and  Direction 

2 

0 

0 

Time  Extension 

22 

0 

0 

0 

Investigation  Generated  by  Commissioner 

2 

21 

3 

0 

Authorization  to  Disregard  a Request 

6 

3 

0 

0 

*Other 

19 

12 

0 

2 

Total 

263 

299 

107 

3 

AMVIR  Statistics  are  from  the  time  period  the  Legislation  came  into  force  May  12,  2004  to  March  31, 2005. 

**Please  refer  to  Appendix  D for  a complete  listing  of  the  PIAs  accepted  by  the  Commissioner  in  the  fiscal  year  2004-2005. 

*Case  types  identified  in  the  "Other" category  include:  Requests  for  Information,  Comments  on  Schemes  and  Programs,  Research  Proposal  Agreements,  Data 
Sharing  Agreements  and  Non-jurisdictional. 

Please  refer  to  Appendix  B for  a complete  listing  of  the  cases  dosed  in  the  2004-2005  fiscal  year. 
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GRAPH  1:  Total  Number  of  Cases  Opened  - A Two  Year  Comparison 
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Generated 

Authorization 
to  Disregard 
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TOTAL 

■ FOIP  Cases  Opened  2005 

162 

7 

65 

13 

3 

25 

4 

3 

22 

304 

■ FOIP  Cases  Opened  2004 

145 

8 

50 

29 

3 

16 

4 

5 

20 

280 

■ HIA  Cases  Opened  2005 

40 

0 

22 

217 

1 

0 

19 

3 

12 

314 

HIA  Cases  Opened  2004 

44 

0 

5 

131 

2 

0 

11 

0 

2 

195 

■ PIPA  Cases  Opened  2005 

54 

0 

128 

0 

0 

0 

6 

0 

0 

188 

PIPA  Cases  Opened  2004 

4 

0 

6 

0 

0 

0 

1 

0 

0 

11 

‘Case  types  identified  in  the  "Other”  category  include:  Requests  for  Information,  Comments  on  Schemes  and  Programs,  Research  Proposal 
Agreements,  Data  Sharing  Agreements  and  Non-jurisdictional. 

Note:  AMVIR  cases  are  not  included  in  Graph  1;  please  see  Table  1. 
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2004/2005  Annual  Report 


GRAPH  2:  Total  Number  of  Cases  Closed  - A Two  Year  Comparison 
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11 

46 

11 
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22 
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19 

263 

■ F0IP  Cases  Closed  2004 

153 

9 

50 

32 

4 

16 
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18 

290 

■ HIA  Cases  Closed  2005 

35 

0 

13 

214 

1 

0 

21 

3 

12 

299 

HIA  Cases  Closed  2004 

32 

0 

21 

113 

3 

0 

8 

0 

2 

179 

■ PI  PA  Cases  Closed  2005 

35 

0 

69 

0 

0 

0 

3 

0 

0 

107 

PI  PA  Cases  Closed  2004 

0 

0 

1 

0 

0 

0 

0 

0 

0 

1 

*Case  types  identified  in  the  ’’Other”  category  include:  Requests  for  Information,  Comments  on  Schemes  and  Programs,  Research  Proposal 
Agreements,  Data  Sharing  Agreements  and  Non-jurisdictional. 

Note:  AMVIR  cases  are  not  included  in  Graph  1 ; please  see  Table  1. 
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TABLE  3:  Cases  Opened  by  Public,  Bodies  Subject  to  the  Legislation,  and  Commissioner  on  own  Motion 


Statistics  are  from  the  period  April  1 , 2004  to  March  31 , 2005 


TYPE 

NUMBER  OF  CASES 

PERCENTAGE 

FOIP 

Investigation  Generated  by  Commissioner 

4 

2% 

Public  Bodies 

59 

19% 

"Public 

241 

79% 

Total 

304 

100% 

HIA 

Investigation  Generated  by  Commissioner 

19 

6% 

Custodian 

231 

74% 

"Public 

64 

20% 

Total 

314 

100% 

PIPA 

Investigation  Generated  by  Commissioner 

6 

4% 

Organization 

0 

0% 

"Public 

182 

96% 

Total 

188 

100% 

AMVIR 

Investigation  Generated  by  Commissioner 

0 

0% 

Public  Bodies 

0 

0% 

"Public 

7 

1 00% 

Total 

7 

100% 

AMVIR  Statistics  are  from  the  time  period  the  Legislation  came  into  force  May  12,  2004  to  March  31, 2005. 

includes  individuals,  media,  agents,  third  party  agents,  agent  applicants,  MLAs,  companies,  others,  special  interest  groups. 
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TABLE  4:  Percentage  of  Cases  Closed  by  Resolution  Method 

Statistics  are  from  the  period  April  1 , 2004  to  March  31 , 2005 


Resolution  Method' 

Number  of 
Cases  [FOIP] 

Number  of 
Cases  [HIA] 

Number  of 
Cases  [PIPA] 

Number  of 
Cases  [AMVIR] 

TOTAL 

Percentage 

^Resolved  by  Mediation/Investigation 

203 

48 

107 

0 

358 

94% 

Resolved  by  Order 

20 

2 

0 

1 

23 

6% 

TOTAL 

223 

50 

107 

1 

381 

100% 

AMVIR  Statistics  are  from  the  time  period  the  Legislation  came  into  force  May  12,  2004  to  March  31,  2005. 

FOIP  Orders:  20  (total  of  27  cases)  HIA  Orders:  2 (total  of  3 cases) 

Note:  Some  Orders  and/or  Report  Numbers  were  assigned  to  more  than  one  case. 

Note:  Orders  are  recorded  by  the  date  the  Order  was  signed,  rather  than  the  date  the  Order  was  publicly  released. 

Note:  *Underthe  legislation,  only  certain  case  types  can  proceed  to  inquiry  if  the  matters  are  not  resolved  at  mediation/investigation.  The  above  statistics  are 
those  case  types  that  can  proceed  to  inquiry  (Request  for  Review  and  Complaint  files). 

Please  refer  to  Tables  1 and  2 and  Appendices  A and  B for  total  cases  opened  and  closed. 

A copy  of  all  Orders  and  Investigation  Reports  are  available  on  the  Office's  web  site  www.oipc.ab.ca 


GRAPH  3: 

Percentage  of  Cases  Closed 
by  Resolution  Method 
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GRAPH  4:  FOIP,  HIA  and  PIPA  Non-case  Related  Telephone  and  E-mail  Enquiries 
April  1 , 2004  to  March  31 , 2005 
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Office  of  the  Information  and  Privacy  Commissioner 

■ LEGISLATIVE  DEVELOPMENTS 

OFFICE  OF  THE  INFORMATION  AND  PRIVACY  COMMISSIONER  OF  ALBERTA 


Access  to  Motor  Vehicle 
Information  Regulation 
(May  2004) 

The  Access  to  Motor  Vehicle  Information  Regulation 
(AMVIR),  a regulation  under  Alberta’s  Traffic  Safety  Act, 
came  into  effect  on  May  1,  2004. 

AMVIR  authorizes  the  Registrar  of  Motor  Vehicle  Services 
to  grant  access  to  personal  driving  and  motor  vehicle 
information  only  for  specific  purposes.  Despite  the  fact 
(common  to  Canadian  provinces)  that  the  release  of  motor 
vehicle  registry  information  is  outside  the  jurisdiction 
of  access  and  privacy  legislation,  AMVIR  allows  any 
person  to  request  a review  by  the  Information  and  Privacy 
Commissioner  of  the  Registrar’s  decision  to  grant  or  deny 
access  to  this  information.  A request  for  review  must  be 
made  within  60  days  of  publication  of  that  decision  on  the 
Registrar’s  website. 

The  function  performed  by  the  Commissioner  in  relation 
to  AMVIR  is  limited.  The  Commissioner  is  restricted  to 
reviewing  decisions  to  grant  or  deny  access  to  personal 
driving  and  motor  vehicle  information  by  the  Registrar. 
The  Commissioner  does  not  have  a general  power  to 
investigate  complaints  related  to  access  under  AMVIR. 


Substantially  similar  finding 
(October  2004) 

The  Governor  in  Council  (federal  cabinet)  found  that 
Alberta’s  Personal  Information  Protection  Act  (PIPA)  is 
substantially  similar  to  the  Federal  Personal  Information 
Protection  and  Electronic  Documents  Act. 

The  substantially  similar  finding  means  the  provincial 
law  rather  than  the  federal  law  governs  the  collection, 
use  and  disclosure  of  personal  information  by  private- 
sector  organizations  in  Alberta.  Personal  information  in 
the  custody  or  control  of  private-sector  organizations  as  it 
relates  to  commercial  transactions  or  activities  is  subject 
to  PIPA.  Personal  employee  information  is  also  covered 
by  the  PIPA. 

The  PIPA  allows  the  Commissioner  to  review  the 
decisions  of  private  sector  organizations  to  deny  an 
individual  access  to  their  own  personal  information,  or 
to  refuse  a request  for  correction  to  their  own  personal 
information.  Individuals  may  also  make  a complaint  to  the 
Commissioner  if  they  believe  their  personal  information 
has  been  collected,  used  or  disclosed  without  proper 
authority  or  without  their  consent. 
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■ FREEDOM  OF  INFORMATION  AND 
PROTECTION  OF  PRIVACY  ACT  (FOIP) 


Under  the  FOIP  Act,  individuals  may  ask  the 
Commissioner  to  review  a public  body’s  response  to  their 
access  to  information  requests  or  requests  for  correction 
of  personal  information.  Third  parties  may  also  ask  the 
Commissioner  to  review  a public  body’s  decision  to  release 
their  information  in  response  to  an  access  request. 

The  FOIP  Act  allows  the  Commissioner  to  investigate 
complaints  that  personal  information  has  been  collected, 
used  or  disclosed  in  contravention  of  the  FOIP  Act  or  to 
initiate  investigations  on  his  own  motion  to  ensure  that 
public  bodies  are  in  compliance  with  the  FOIP  Act. 

Cases  Opened 

In  2004-2005,  the  Commissioner  opened  a total  of  304 
cases  under  the  FOIP  Act.  This  is  an  8.5%  increase  from 
the  280  cases  opened  the  previous  fiscal  year. 

Two  hundred  and  forty  one  (or  79%)  of  the  FOIP  cases 
opened  were  initiated  by  the  public  such  as  individuals, 
media,  agents,  third  parties,  businesses,  etc.  The  remaining 
63  (or  21%)  of  the  FOIP  cases  opened  were  initiated  by 
public  bodies. 

Requests  for  Review  Received 

In  2004-2005,  162  (or  62%)  of  the  Requests  for  Reviews 
received  by  OIPC  were  related  to  access  requests  made 
pursuant  to  the  FOIP  Act.  Of  these  cases,  41%  were 
with  provincial  government  ministries,  20%  with  law 
enforcement  agencies,  and  20%  with  municipalities. 

Complaints  Received 

In  2004-2005,  the  Commissioner  authorized  69  privacy 
investigations  under  the  FOIP  Act  (65  in  response  to 
complaints  and  4 on  his  own  initiative).  Twenty-two 
(or  32%)  of  the  investigations  were  with  provincial 


government  ministries;  11  (or  16%)  with  boards;  and  10  (or 
1 5%)  with  law  enforcement  agencies. 

Resolution  by 
Mediation/Investigation 

Of  the  265  FOIP  cases  closed  in  2004-2005,  223  could 
have  proceeded  to  inquiry.  However,  the  FOIP  Team 
successfully  resolved  203  cases  (or  91%)  through  the 
mediation/investigation  process,  leaving  20  cases  to  be 
resolved  by  Commissioner’s  Order. 

Consultation 

The  FOIP  Team  provides  consultation  to  public  bodies  on 
complex  and  multi-jurisdictional  issues  relating  to  access 
and  privacy.  This  includes  reviewing  and  commenting 
on  program  initiatives,  policies,  procedures  and  practices 
such  as: 

• Working  with  school  jurisdictions  and  university 
researchers  to  develop  a better  understanding  of  the 
application  of  the  FOIP  Act  in  relation  to  research 
projects  in  schools;  clarifying  issues  that  are  relevant  to 
the  FOIP  Act  and  issues  that  are  outside  the  FOIP  Act. 

• Liaising  with  school  jurisdictions,  media  and  police 
services  on  the  issue  of  alcohol  and  drug  testing  and 
detection  programs  in  schools. 

Privacy  Impact  Assessments 

The  FOIP  Act  does  not  require  public  bodies  to  prepare  a 
Privacy  Impact  Assessment  (PIA)  or  submit  the  PIA  to  the 
Commissioner  for  review  and  comment. 

However,  public  bodies  recognize  that  a PIA  can  be  a 
useful  tool  to  assist  in  identifying  and  assessing  privacy 
implications  and  risks  for  new  or  enhanced  initiatives. 
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Public  bodies  may  use  the  PIA  template  developed  by  the 
Commissioner’s  Office  or  a PIA  form  of  their  own  design. 

Some  public  bodies  have  adopted  the  use  of  a Privacy 
Impact  Statement  (a  shortened  version  of  a PIA)  to 
assess  privacy  implications  on  enhancements  to  existing 
programs  or  initiatives. 

The  Commissioner  recommends  that  public  bodies 
continue  to  use  PIAs  when  considering  new  programs  or 
initiatives  that  include  personal  information. 

Investigation  Reports 

F2004-IR-003  (Issued  December  2004) 

Alberta  Personnel  Office  and  Solicitor  General 

In  November  2004,  the  Edmonton  Police  Service  recovered 
documents  containing  personal  information  of  senior 
government  employees  in  a hotel  room  during  a credit 
card  investigation.  The  documents  were  related  to  the 
credit  screening  process  required  under  the  Alberta 
Government  Security  Screening  Directive  (the  Directive). 

The  Commissioner  received  two  complaints  from  affected 
employees  on  this  matter  and  authorized  an  investigation 
pursuant  to  the  FOIP  Act.  On  December  16,  2004,  the 
Commissioner  publicly  released  the  report  on  the  findings 
and  recommendations  of  the  investigation  conducted  by 
his  Office. 

The  investigation  found  that  the  Privacy  Impact 
Assessment  regarding  the  Directive,  which  was  accepted 
by  the  Commissioner  in  January  2003,  was  not 
followed.  As  a result,  personal  information  was  collected 
in  contravention  of  the  FOIP  Act.  In  addition,  the 
investigation  found  that  PAO  and  Solicitor  General  did 
not  fulfill  their  obligations  to  protect  personal  information 
as  required  by  the  FOIP  Act.  Both  PAO  and  Solicitor 
General  accepted  the  recommendations  outlined  in  the 
investigation  report. 


Orders 

F2004-032  (Issued  February  2005) 

Adjudicator  orders  Calgary  Police  Service  to 
release  records 

The  Applicant  requested  access  under  the  FOIP  Act  to 
information  regarding  a complaint  filed  with  the  Calgary 
Police  Service  (CPS),  including  case  notes,  witness 
statements  and  a chapter  from  a procedures  manual  of 
the  CPS. 

The  CPS  released  the  responsive  records  but  severed 
excerpts  from  the  procedures  manual,  relying  on  sections 
18  (individual  health  or  safety,  or  public  safety)  and  20 
(law  enforcement).  The  Adjudicator  found  that  the  CPS 
had  not  provided  evidence  to  fulfill  the  “harms”  tests 
necessaiy  for  the  application  of  section  18  and  20.  The 
Adjudicator  also  found  that  there  was  nothing  on  the  face 
of  the  records  to  support  an  expectation  that  harm  would 
result  from  disclosure,  and  ordered  the  records  released. 

F2004-01 7 (Issued  March  2005) 

Commissioner  upholds  decision  to  withhold  records 
regarding  legal  costs  incurred  by  the  Alberta  Government 

The  Applicant  applied  to  Alberta  Justice  for  access  to 
information  regarding  the  legal  costs  incurred  by  the 
Alberta  Government  in  proceeding  with  the  case  entitled, 
Reference  Re:  Firearms  Act. 

The  Commissioner  found  that  “solicitor-client  privilege” 
applied  to  the  records  and  that  Alberta  Justice  had  properly 
applied  section  27(1)  of  the  FOIP  Act.  The  Applicant  had 
not  established  that  the  matter  was  of  compelling  public 
interest  and  therefore  the  override  provision  found  in 
section  32  (public  interest)  did  not  apply. 
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■ HEALTH  INFORMATION  ACT  (HIA) 


Health  Information  Act  (HIA)  has  been  in  force  since  April 
25,  2001.  The  law  applies  to  custodians,  which  includes 
regional  health  authorities,  hospitals,  nursing  homes, 
pharmacists,  physicians  and  other  health  service  providers 
paid  under  the  Alberta  Health  Care  Insurance  Plan  to 
provide  health  services.  The  Information  and  Privacy 
Commissioner  is  responsible  for  reviewing  the  access  to 
information  decisions  of  custodians,  investigating  how 
custodians  collect,  use  and  disclose  health  information 
and  ensuring  that  reasonable  measures  have  been 
taken  to  protect  the  privacy  and  confidentiality  of  that 
information. 

This  past  year  the  HIA  Team  focused  its  efforts  on 
overseeing  the  implementation  of  electronic  health  record 
systems  (EHRs),  assessing  regional  health  authority  (RHA) 
compliance  strategies  and  assisting  with  the  legislated 
three  year  review  of  the  HIA. 

EHR  Comments 

Fiscal  2004  saw  continued  implementation  of  EHRs 
in  Alberta.  There  are  four  key  EHR  applications  in 
various  stages  of  implementation:  the  provincial  EHR 
and  three  regional  EHRs  that  consist  of  Capital  Health’s 
netCARE,  Calgary  Health  Region’s  EHR  and  the  Regional 
Shared  Health  Information  Project  (RSHIP),  which  is  a 
collaboration  of  the  seven  non-metro  health  regions  using 
a suite  of  integrated  applications  and  a shared  data  centre 
delivery  model.  Oversight  for  the  implementation  of  EHRs 
is  a priority  for  the  Commissioner  and  accounts  for  a 
significant  percentage  of  the  HIA  Team’s  resources.  The 
HIA  Team  works  collaboratively  with  custodians  during 
the  implementation  process  to  assist  in  the  examination  of 
reasonable  safeguards  to  protect  health  information. 

The  HIA  requires  custodians  to  prepare  and  submit  a 
Privacy  Impact  Assessment  (PIA)  to  the  Commissioner 
for  review  and  comment  prior  to  implementing  a new 
practice  or  system  or  making  a change  to  an  existing 
practice  or  system.  A PIA  is  the  tool  through  which  a 


custodian  assesses  confidentiality,  privacy  and  security. 

We  are  pleased  to  report  this  year  saw  a 90  percent 
increase  in  the  number  of  PLAs  reviewed.  We  believe  this 
demonstrates  an  increase  in  custodian  efforts  to  comply 
with  PIA  requirements  and  provides  reasonable  assurance 
that  proper  safeguards  are  in  place  to  protect  the  health 
information  of  Albertans. 

The  HIA  Team  has  also  continued  its  involvement  with 
the  Physician  Office  System  Program  (POSP)  in  the 
examination  and  establishment  of  Vendor  Conformance 
and  Usability  Requirements  (VCUR),  which  include  privacy 
and  security  standards  for  the  implementation  of  an 
electronic  medical  record  for  a physician’s  office.  The 
POSP  has  diligently  worked  towards  assisting  physicians 
in  meeting  HIA  requirements.  It  is  noteworthy  that  98 
POSP  PLAs  were  reviewed  this  year. 

RHA  Compliance  Strategies 

The  HIA  Team  has  seen  an  increased  level  of  involvement 
with  regional  health  authorities  in  the  early  examination 
of  privacy  and  security  breaches.  This  is  the  result  of  our 
recommendation  to  custodians  to  self  report  breaches. 

This  affords  our  Office  an  opportunity  to  actively  assist 
the  custodian  in  its  examination  and  determination  of  the 
action  necessaiy  to  address  the  incident. 

This  year  also  saw  the  first  of  what  will  become  an 
annual  regional  health  authority  HIA  compliance 
meeting.  This  meeting,  with  key  RHA  staff  responsible 
for  confidentiality,  privacy  and  security  matters, 
collaboratively  examines  each  RHAs  level  of  compliance 
with  the  HIA,  which  could  lead  to  recommendations  to 
address  gaps. 
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Legislative  Review  of  the  HIA 

This  fiscal  year  saw  the  first  mandated  review  of  the  HIA 
by  an  all-party  Committee  appointed  by  the  Legislative 
Assembly.  One  HIA  Team  member  provided  technical 
support  to  the  Committee  during  this  review  process. 

Due  to  an  impending  provincial  election  call,  the 
Committee  was  unable  to  address  all  of  the  issues  that 
were  identified  through  the  consultation  process.  As  a 
result,  the  Committee  recommended  that  some  matters, 
such  as  scope  of  the  HIA  and  harmonization  with  the  pan- 
Canadian  health  information  privacy  and  confidentiality 
network,  be  deferred  to  a future  committee  of  the 
Legislature. 

The  Committee  made  a total  of  59  recommendations 
regarding  the  legislation.  Alberta  Health  and  Wellness 
has  committed  to  examining  these  recommendations  for 
potential  amendments  of  the  HIA  during  fiscal  2005. 

Orders 

H2004-004  (Issued  July  2004) 

Commissioner  confirms  Custodian's  decision  not 
to  correct  or  amend  professional  opinion 

The  Applicant  alleged  that  Dr.  Goldie  (the  Custodian) 
improperly  refused  to  correct  or  amend  her  physician 
office  records  in  contravention  of  the  Health  Information 
Act.  The  commissioner  found  there  was  no  error  or 
omission  in  the  Applicant’s  health  information  that  could 
be  corrected  under  the  Act.  The  commissioner  issued 
Order  H224-004,  in  which  he  confirmed  the  Custodian’s 
decision  not  to  correct  or  amend  health  information 
that  was  an  accurate  description  of  the  Custodian’s 
professional  opinion  and  observations. 


H2004-005  (Issued  January  2005) 

Commissioner  finds  Custodian  disclosed  health 
information  for  purposes  of  a court  proceeding  in 
accordance  with  the  Act 

The  Complainant  said  that  Dr.  Murji  (the  Custodian) 
disclosed  his  health  information  to  the  Canadian 
Medical  Protective  Association  (CMPA)  in  contravention 
of  the  Health  Information  Act.  The  Complainant  had 
brought  a medical  malpractice  action  against  three 
physicians  but  not  against  the  Custodian  who  was  the 
complainant’s  treating  physician.  The  CMPA,  which  is 
a defence  organization  or  quasi-insurer  for  physicians, 
was  representing  the  three  defendant  physicians.  In  an 
interview  with  legal  counsel  for  the  CMPA,  the  Custodian 
disclosed  information  about  the  Complainant’s  medical 
treatment.  The  Complainant  had  expressly  objected  to 
the  interview. 

The  Commissioner  issued  order  H2004-005,  in  which 
he  found  that  section  3(a),  which  says  the  Act  does  not 
limit  information  otherwise  available  by  law  to  a party 
to  legal  proceedings,  allows  the  Act  and  the  common  law 
to  co-exist  and  did  not  remove  this  disclosure  from  the 
scope  of  the  Act.  He  found  the  Custodian  disclosed  the 
health  information  in  accordance  with  section  35(l)(h)  of 
the  Act  as  the  information  was  disclosed  for  the  purpose 
of  a court  proceeding.  Section  58(2)  of  the  Act  did  not 
apply  as  the  only  issue  was  whether  the  Custodian  could 
grant  the  interview,  not  the  amount  of  information 
disclosed  during  the  interview.  The  Commissioner  also 
found  that  the  Custodian  had  properly  exercised  her 
discretion  to  disclose. 

On  March  23,  2005,  Commissioner  Frank  Work  filed 
Order  H2004-005  in  the  Court  of  Queen’s  Bench  of 
Alberta.  As  provided  by  section  80(6)  of  the  HIA,  Order 
H2004-005  is  now  enforceable  as  a judgement  or  order  of 
that  Court. 
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■ PERSONAL  INFORMATION 
PROTECTION  ACT  (PIPA) 


Under  the  PIPA,  individuals  may  ask  the  Commissioner  to 
investigate  complaints  that  personal  information  has  been 
collected,  used  or  disclosed  in  contravention  of  the  PIPA 
or  to  initiate  investigations  on  his  own  motion  to  ensure 
compliance  with  the  Act. 

Also  under  the  PIPA,  individuals  may  ask  the 
Commissioner  to  review  an  organization’s  response 
to  their  access  request,  or  requests  for  correction  of 
personal  information. 

Cases  Opened: 

2004-2005  was  the  first  full  year  under  the  new 
legislation.  In  this  period,  the  Commissioner  opened  a 
total  of  188  cases.  Seventy-two  percent  (72%)  of  the 
cases  were  complaints,  and  twenty-eight  percent  (28%) 
of  the  cases  were  requests  for  review.  Investigations  of 
complaints  requires  extensive  fact-finding,  educating 


organizations  about  the  new  act  and  their  obligations,  and 
becoming  familiar  with  industry  standards  and  regulations 
in  the  wide  variety  of  organizations  that  make  up  the 
business  and  non-profit  sector. 

Resolution  by  Mediation/ 
Investigation 

Of  the  188  PIPA  cases  opened  in  2004/2005,  107  were 
closed.  The  PIPA  Team  successfully  resolved  100%  of 
the  cases  through  the  mediation/investigation  process. 

In  this  time  period,  no  cases  were  resolved  by  a 
Commissioner’s  Order. 
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Over  the  past  year  the  OIPC  was  involved  in,  or 
highlighted,  a number  of  issues  related  to  access  and 
privacy  in  Alberta  and  Canada.  The  Commissioner  has  the 
mandate  to  inform  Albertans  about  issues  affecting  their 
access  and  privacy  rights,  including  identifying  schemes 
and  programs  from  the  provincial  and  federal  governments 
that  have  access  and  privacy  implications  in  Alberta. 

Commissioner  urges  businesses  to  consider  privacy 
obligations  before  implementing  RFID  technology 

(April  2004) 

Commissioner  Frank  Work  urged  Alberta  businesses  to 
consider  their  privacy  obligations  prior  to  implementing 
radio  frequency  identification  (RFID)  devices. 

RFID  tags  are  commonly  used  in  the  retail  industry  to 
track  inventory  and  purchasing  information.  Similar  to 
bar  codes,  the  tags  contain  data  that  can  be  transmitted 
and  collected  by  the  organization  utilizing  the  technology. 

RFID  chips  can  be  embedded  into  products  and  clothing 
and  covertly  read  without  the  knowledge  of  the  individual. 
A small  tag  embedded  into  an  article  of  clothing  could  be 
activated  every  time  the  customer  entered  or  left  the  store 
where  the  item  was  bought.  That  tag  could  also  be  read 
by  any  other  business  or  government  department  that  has 
installed  a compatible  reader. 

While  RFID  tags  are  currently  used  primarily  to  identify 
and  manage  products,  the  technology  has  the  potential  for 
a much  wider  application.  As  a result,  organizations  need 
to  be  aware  that  there  may  be  privacy  implications  when 
RFID  product  identification  data  is  linked  to  a specific 
individual,  for  example  through  credit  card  or  loyalty  card 
information. 

Commissioner  Work  wanted  businesses  to  consider  some 
key  points  prior  to  implementation: 


• Whether  the  same  purpose  may  be  achieved  using  less 
invasive  means. 

• If  the  decision  is  made  to  use  RFID  technology,  ensure 
that  it  is  done  in  an  open  and  transparent  way;  this 
means  informing  individuals  that  products  contain 
RFID  tags,  and  obtaining  their  consent  when  necessary. 

• Similarly,  individuals  must  be  made  aware  of  the 
specific  purpose  for  which  their  personal  information 
is  being  collected,  and  organizations  must  use  the 
information  only  for  that  purpose. 

• Strict  controls  regarding  security  and  the  integrity  of 
the  technology  must  be  implemented. 

• Individuals  should  have  the  ability  to  deactivate  or 
disable  RFID  tags,  as  appropriate. 

• Any  personal  information  collected  should  be  retained 
only  as  long  as  necessary  to  carry  out  the  original 
purpose. 

• Individuals  should  have  the  ability  to  ask  questions 
about  the  technology  and  receive  accurate,  timely 
responses  from  the  organization. 

Commissioner  urges  schools  to  consider 
privacy  obligations  before  implementing 
drug  detection  programs 

(April  2004) 

Recent  media  reports  during  this  time  highlighted  the 
concern  some  school  administrators  have  regarding 
illicit  drug  use  among  students,  a concern  which  the 
Commissioner  also  shares.  Some  reports  indicated  schools 
are  contemplating  methods  of  determining  the  potential 
presence  of  drugs  on  school  premises,  most  notably 
through  ‘drug  sniffing  dogs’  or  use  of  individual  drug  use 
detection  devices,  specifically  saliva  tests. 

While  the  Commissioner  appreciated  the  schools’  desire  to 
ensure  a safe  environment  for  its  students,  he  wanted  to 
remind  schools  that  they  have  certain  obligations  under 


24] 


Office  of  the  Information  and  Privacy  Commissioner 


the  FOIP  Act.  Drug  detection  programs  may  involve 
the  collection  of  personal  information  and  as  such  the 
provisions  of  the  FOIP  Act  need  to  be  considered. 

The  Commissioner  stressed  that  the  FOIP  Act  is  not 
intended  to  prevent  or  diminish  school  efforts  to  address 
safety  and  health  issues  or  in  detecting  and  preventing 
possible  criminal  activities.  In  fact,  the  FOIP  Act  when 
applied  correctly  promoted  these  efforts. 

The  Commissioner  advised  schools  to  consider  the  least 
privacy  intrusive  methods,  when  contemplating  policies 
for  drug  use  prevention  and  detection: 

• Individually  applied  drug  tests  generally  only  detect 
the  presence  of  a drug.  Consumption  could  have 
occurred  days  or  even  weeks  prior.  Observant  and 
involved  school  officials  may  be  able  to  reach  similar 
conclusions  in  their  day-to-day  interaction  with 
students. 

• Drug  sniffing  dogs  may  be  cost  excessive  and  a similar 
effect  can  be  accomplished  by  encouraging  students 
and  staff  to  report  illegal  activity  to  school  officials. 

If  a decision  is  made  to  use  a detection  process  or  test: 

• Ensure  that  it  is  done  in  an  open  and  transparent  way, 
with  a written  policy  that  is  communicated  to  students 
and  parents. 

• Ensure  the  policy  addresses  all  FOIP  requirements, 
including  the  school’s  authority  to  collect  personal 
information,  provisions  that  address  use  and  disclosure 
of  the  personal  information  and  provisions  that  address 
security,  accuracy  and  retention  of  records. 

• Ensure  that  individuals  have  the  ability  to  ask 
questions  about  the  policy. 

• Use  detection  tests  only  as  the  last  resort;  and 

• Do  not  use  random  tests. 

The  Commissioner  was  encouraged  that  schools  were 
actively  pursuing  effective  methods  for  combating  illicit 
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drug  use  among  youth.  However,  as  drug  detection 
programs  are  significant  invasions  of  an  individual’s 
privacy,  the  Commissioner  recommended  that  alternate, 
less  intrusive,  methods  be  considered  first,  including 
education,  peer  support  and  counseling. 

OIPC  clarifies  when  health  service  providers  can 
disclose  patients'  health  information 

(July  2004) 

Following  a story  from  Vancouver  ( Vancouver  Sun,  page 
A01,  July  10,  2004)  involving  the  tragic  death  of  a young 
woman  and  the  issue  of  whether  health  service  providers 
should  have  spoken  to  the  woman’s  family  about  her 
condition  prior  to  her  death,  the  health  service  providers 
claimed  that  privacy  laws  precluded  them  from  discussing 
the  woman’s  condition  with  her  family. 

The  Office  of  the  Information  and  Privacy  Commissioner 
(OIPC)  wanted  to  make  sure  that  health  service  providers 
in  Alberta  were  aware  of  circumstances  under  which  they 
can  discuss  a person’s  health  information  with  others. 

Alberta’s  Health  Information  Act  gives  health  service 
providers  significant  discretion  in  determining  when 
health  information  should  be  released  to  family 
members.  Health  service  providers  can  provide  general 
information  on  the  patient’s  condition,  diagnosis  and 
prognosis  to  family  members  or  others  with  a close 
personal  relationship.  Likewise,  family  or  others  with 
a close  personal  relationship  can  be  contacted  where 
an  individual  is  injured,  ill  or  deceased.  Both  of  these 
provisions  stipulate  that  the  disclosure  of  information  can 
only  take  place  if  the  patient  has  not  requested  that  this 
information  not  be  disclosed. 

Of  course,  should  a health  service  provider  feel  that  the 
disclosure  of  health  information  is  necessary  to  minimize 
or  avert  an  imminent  danger  to  the  health  or  safety 
of  any  person,  the  information  can  be  released  to  any 
person.  If  someone  feels  that  a health  service  provider 
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has  not  exercised  their  judgment  properly  in  releasing 
information,  they  can  ask  the  Information  and  Privacy 
Commissioner  to  review  the  matter.  The  Commissioner 
will  consider  whether  a reasonable  person  in  the  position 
of  the  health  service  provider  would  have  done  the  same 
thing  at  that  time. 

Alberta,  British  Columbia  and  Federal  Privacy 
Commissioners  provide  guidelines  for  how  provincial 
and  federal  private-sector  privacy  laws  work  together 

(July  2004) 

Frank  Work,  Information  and  Privacy  Commissioner 
issued  a “Question  and  Answer”  document  to  help  private 
sector  organizations  and  individuals  understand  the 
application  of  Alberta  and  British  Columbia’s  Personal 
Information  Protection  Acts  (PIPAs)  and  the  federal 
Personal  Information  Protection  and  Electronic  Documents 
Act  (PIPEDA).  These  laws  set  national  standards  for 
privacy  practices  in  the  private  sector. 

The  document  was  developed  by  the  Alberta  and  the 
British  Columbia  Information  and  Privacy  Commissioners, 
in  consultation  with  the  Office  of  the  Privacy 
Commissioner  of  Canada.  The  document  is  intended  to 
answer  questions  that  organizations  and  individuals  may 
have  about  jurisdiction  for  privacy  oversight  and  how  the 
laws  work  together. 

The  creation  of  these  guidelines  was  part  of  the 
cooperative  work  undertaken  by  the  Alberta,  British 
Columbia  and  Federal  Privacy  Commissioners.  The  intent 
of  this  cooperation  was  to  simplify  and  harmonize  privacy 
protection  to  ensure  that  it  is  both  practical  for  businesses 
and  respectful  of  citizens’  privacy  rights. 

Commissioner  releases  investigation  report  regarding 
privacy  complaints  against  EPCOR 

(July  2004) 


Frank  Work,  Information  and  Privacy  Commissioner, 
received  privacy  complaints  against  EPCOR,  an  electric 
utility  company.  The  Complainants  said  EPCOR 
contravened  the  Personal  Information  Protection  Act  (PIPA 
or  the  Act)  by  collecting  personal  information  in  excess  of 
what  was  necessary  to  manage  customer  accounts. 

Complainants  were  especially  concerned  about  the 
collection  and  use  of  social  insurance  numbers,  and  other 
personal  information  for  authenticating  callers  over  the 
telephone.  The  investigation  found  that: 

• The  company  did  not  adequately  notify  customers  as 
to  the  purposes  for  which  social  insurance  numbers 
were  used,  and  did  not  obtain  the  appropriate  form  of 
consent  for  these  purposes, 

• The  company  was  collecting  personal  information 
beyond  what  was  required  for  their  business  purposes, 

• Although  security  practices  were  in  place,  adjustments 
to  access  protocols  were  needed  to  safeguard  and 
ensure  the  confidentiality  of  social  insurance  numbers. 

EPCOR  had  instituted  new  privacy  procedures  prior  to 
January  1,  2004,  but  readily  acknowledged  the  need 
for  changes  to  its  procedures  in  response  to  customer 
concerns.  EPCOR  committed  to  undertake  a privacy 
audit  and  work  with  the  Office  of  the  Information  and 
Privacy  Commissioner  to  ensure  full  compliance  with  the 
recommendations  of  the  investigation. 

Commissioner  responds  to  the  Final  Report  of 
the  Select  Special  Health  Information  Act  Review 
Committee 

(October  2004) 

The  Information  and  Privacy  Commissioner  issued  his 
comments  on  the  release  of  the  Final  Report  of  the  Select 
Special  Health  Information  Act  Review  Committee. 
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There  were  a number  of  positive  outcomes  arising  from 

the  Committee’s  recommendations  including: 

• The  authority  to  publish  ethics  committee  research 
approvals  on  a website  as  it  provides  for  increased 
openness,  accountability  and  transparency  for 
Albertans, 

• Recommending  against  certain  disclosures  without 
consent,  specifically  disclosure  for  common  or 
integrated  government  programs. 

The  Commissioner  also  had  a number  of  concerns  with 

some  of  the  Committee’s  recommendations,  including  the 

failure  to  address  substantive  issues  such  as: 

• The  issue  of  expanding  the  scope  of  the  Act  to  include 
privately  funded  health  professionals,  organizations  and 
health  clinics  of  post-secondary  educational  institutions 
was  deferred  to  a committee  of  the  Legislature  to  be 
established  in  early  2005.  The  Commissioner  believes 
that  this  leaves  a gap  in  legislation  with  no  provincial 
access  or  privacy  legislation  for  the  privately  funded 
health  sector  and  needs  to  be  addressed  immediately. 

Also  deferred  to  the  future  2005  committee: 

• examining  the  need  for  more  clear  and  transparent 
rules  for  the  electronic  health  record, 

• harmonizing  the  Act  to  the  rules  of  the  pan-Canadian 
health  information  privacy  and  confidentiality 
framework, 

• whether  genetic  information  should  be  explicitly 
addressed, 

• whether  health  service  provider  information  should 
remain  under  the  Act, 

• the  Commissioner’s  request  for  the  explicit  right  to 
conduct  and  compel  information  for  purposes  of 
conducting  audits,  and 

• the  Commissioner’s  request  for  explicit  power  to  enter 
into  extra-provincial  agreements  and  to  consult  and 
delegate  extra-provincially. 


The  Commissioner  was  not  opposed  to  the  creation  of  a 
discretionary  authority  for  custodians  to  disclose  limited 
registration  information  to  law  enforcement  agencies  for 
the  purposes  of  obtaining  search  warrants  or  subpoenas. 
However,  he  opposed  the  creation  of  mandatory  disclosure 
and  reporting  of  health  information  to  law  enforcement  and 
was  concerned  about  the  lack  of  certainty  for  custodians. 

Commissioner  releases  investigation  report  regarding 
a complaint  about  disclosure  of  customer  information 
among  the  Melrose  Rural  Electrification  Association, 
ATCO  Electric  and  Direct  Energy  Marketing  Limited. 

(October  2004) 

Frank  Work,  Information  and  Privacy  Commissioner, 
received  a privacy  complaint  concerning  the  above  named 
organizations.  The  Complainant  was  concerned  that  the 
Melrose  Rural  Electrification  Association  (Melrose  REA) 
and  its  service  provider,  ATCO  Electric,  disclosed  customer 
information  to  Direct  Energy  Marketing  Limited  in 
contravention  of  the  Personal  Information  Protection  Act 
(PIPA  or  the  Act). 

In  2004,  as  part  of  a sale  of  retail  electricity  assets,  ATCO 
Electric  transferred  customer  information  of  members 
of  the  Melrose  REA  to  Direct  Energy  Marketing  Limited 
(DEML).  DEML  took  over  the  regulated  rate  tariff  and 
billing  service  previously  provided  by  ATCO  Electric. 

The  investigation  found  that: 

• the  disclosure  of  personal  information  between  the 
parties  was  done  in  accordance  with  PIPA,  which 
allows  disclosure  without  consent  if  the  future  use  and 
disclosure  of  personal  (customer)  information  is  limited 
to  the  provision  of  services  originally  undertaken  by 
ATCO  Electric;  and 

• the  personal  information  disclosed  to  DEML  was 
limited  to  what  was  required  to  carry  on  the  business 
- i.e.  provide  electricity  and  bill  for  services. 
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This  report  outlines  organizations’  privacy  obligations 
when  personal  information  is  disclosed  through  mergers, 
acquisitions  and  other  similar  business  transactions. 

Commissioner  cracks  down  on  businesses  whose 
practices  assist  identity  thieves 

(November  2004) 

Following  an  Edmonton  Police  Service  investigation  where 
two  people  were  charged  in  a credit  check  investigation, 
the  Office  of  the  Information  and  Privacy  Commissioner 
announced  it  would  crack  down  on  businesses  whose 
practices  aid  identity  thieves. 

The  police  found  information  consisting  of  sensitive 
personal  financial  information  of  individuals,  such  as 
cell  phone  contracts,  credit  information  held  by  a debt 
collection  agency,  bank  account  information,  and  return 
of  goods  slips  with  detailed  credit  card  information.  In 
the  hands  of  unauthorized  persons,  personal  information 
of  this  kind  can  be  used  to  steal  identities  and  open  bank 
accounts,  make  credit  card  charges,  rent  vehicles,  and 
redirect  mail,  among  other  things. 

“Businesses  are  making  it  too  easy  for  identity  thieves,” 
said  Commissioner  Frank  Work.  “It  is  a priority  of  this 
office  to  stop  businesses  from  engaging  in  practices  that 
put  Albertans’  personal  information  at  risk,”  added  the 
Commissioner. 

Organizations  under  Alberta’s  Personal  Information 
Protection  Act  and  Section  34  in  particular,  are  obligated 
to  safeguard  personal  information  especially  when 
disposing  of  or  destroying  information. 

The  Commissioner  reminded  organizations  of  the  risks 
that  result  from  insecure  disposal  and  destruction  of 
personal  information. 


Alberta's  Information  and  Privacy  Commissioner 
undertakes  review  of  public  sector  outsourcing 

(December  2004) 

The  Information  and  Privacy  Commissioner  announced 
that  his  office  will  be  working  jointly  with  the 
Government  of  Alberta  to  examine  the  implications  of 
public  sector  outsourcing  for  the  personal  information 
of  Albertans.  “Outsourcing”  in  this  context  referred  to 
contracting  out  business  functions  that  involve  Albertans’ 
personal  information. 

The  review  followed  on  the  British  Columbia  report  titled, 
Privacy  and  the  USA  Patriot  Act,  Implications  for  British 
Columbia  Public  Sector  Outsourcing.  British  Columbia’s 
Information  and  Privacy  Commissioner  released  the  151- 
page  report  on  October  29. 

Under  an  arrangement  between  the  Office  of  the 
Information  and  Privacy  Commissioner  and  Alberta 
Government  Services,  a working  group  would  identify 
current  outsourcing  arrangements  with  contractors  outside 
of  Canada  and  identify  current  outsourcing  arrangements 
with  contractors  inside  Canada,  but  affiliated  with  entities 
outside  of  Canada.  The  review  would  include  provincial 
and  municipal  governments,  certain  police  forces,  school 
boards  and  regional  health  authorities,  among  others. 

The  review  would  consist  of  three  parts.  First,  outsourcing 
agreements  will  be  identified.  Second,  the  potential  for 
unintended  disclosure  of  personal  information  to  foreign 
law  enforcement  agencies  would  be  assessed.  Finally, 
measures  that  could  be  taken  to  reduce  unintended 
disclosures  would  be  identified,  and  recommended  to 
Government. 

The  Commissioner  expects  to  publicly  release  his  findings 
and  recommendations  in  early  2006.  In  September  2004, 
Commissioner  Work  stated  that  his  Office  would  review 
public  sector  outsourcing  in  Alberta  once  the  B.C.  report 
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was  released,  and  assess  “what  the  risks  are  with  respect  to 
the  personal  information  of  Albertans,  and  what  remedies 
there  might  be.” 

Joint  investigation  confirms  breaches  of  provincial/ 
federal  legislation 

(December  2004) 

For  the  first  time,  the  Office  of  the  Information  and 
Privacy  Commissioner  of  Alberta  (OIPC)  and  the  Office 
of  the  Privacy  Commissioner  of  Canada  (OPC)  have 
collaborated  in  conducting  parallel  investigations  and 
determined  that  misdirected  faxes  sent  to  an  Alberta 
couple  were  in  contravention  of  provincial  and  federal 
privacy  laws. 

On  July  1,  2004,  an  article  appeared  in  an  Edmonton 
newspaper  reporting  that  a local  couple  had  received 
numerous  faxes  in  error.  The  article  suggested  the  errant 
faxes  may  have  pertained  to  communications  between 
health  service  providers  and  may  have  also  contained 
health  information  about  identifiable  individuals. 

A preliminary  investigation  determined  that  several  of 
the  parties  who  were  responsible  for  sending  the  records 
are  not  subject  to  Alberta’s  Health  Information  Act. 
However,  some  of  the  information  fell  under  federal 
jurisdiction  through  the  Personal  Information  Protection 
and  Electronic  Documents  Act. 

The  results  of  both  investigations  determined  that  human 
error  was  responsible  for  the  privacy  breaches.  The 
OIPC  and  the  OPC  recommended  that  the  organizations 
implement  additional  measures  to  protect  personal 
information  including  a process  whereby  individuals 
may  be  notified  when  their  personal  information  has 
been  inadvertently  disclosed  when  facsimiles  have  been 
transmitted  and  received  at  an  incorrect  facsimile  number. 

Recently,  Alberta’s  Information  and  Privacy  Commissioner 
asked  the  Select  Special. Health  Information  Act  Review 


Committee  to  provide  his  Office  with  additional  powers 
to  enter  into  extra-provincial  agreements.  These  powers 
are  intended  to  be  used  where  more  than  one  jurisdiction 
may  be  involved  in  investigation  of  the  same  matter.  The 
Committee  recommended  this  matter  be  deferred  to  a new 
Committee  of  the  Legislature  early  in  2005. 

Investigations  find  Alberta  businesses  failed  to  protect 
personal  information  from  identity  thieves 

(February  2005) 

Investigations  by  the  Office  of  the  Information  and  Privacy 
Commissioner  (OIPC)  found  that  three  Alberta  businesses 
failed  to  protect  personal  information  in  their  custody. 

On  November  24,  2004,  Edmonton  Police  Service  (EPS) 
notified  the  OIPC  that  documents  containing  personal 
information  from  a number  of  Alberta  businesses  were 
found  during  a police  investigation.  Some  of  the  records 
were  found  in  a motel  room;  others  were  subsequently 
turned  over  to  police  by  two  individuals  charged  with 
credit  card  fraud.  The  records  included  return  of  goods 
slips,  debtor  account  files  from  a collection  agency, 
and  cell  phone  contracts.  Personal  information  in  the 
records  included  Social  Insurance  Numbers,  bank  account 
information,  credit  card  numbers,  and  customer  signatures. 

In  response  to  the  information  from  EPS,  Information  and 
Privacy  Commissioner  Frank  Work  initiated  investigations 
of  Linens  ‘N  Things,  Nor-Don  Collection  Network  Inc.,  and 
Digital  Communications  Group  Inc.,  under  the  Personal 
Information  Protection  Act  (PIPA  or  the  Act). 

PIPA  applies  to  private  sector  organizations  in  Alberta, 
and  requires  them  to  protect  personal  information 
against  such  risks  as  unauthorized  access,  collection,  use, 
disclosure,  copying,  modification,  disposal  or  destruction. 
The  investigators  found  that  these  businesses  failed  to 
protect  personal  information  in  their  custody. 
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Recommendations  from  the  investigations  required  all 
three  organizations  to  contact  the  individuals  whose 
information  was,  or  may  have  been,  exposed  to  identity 
theft.  In  at  least  one  case  this  meant  contacting  hundreds 
of  customers. 

Additional  recommendations  required  the  organizations  to: 

• ensure  all  records  containing  personal  information  are 
stored  securely, 

• limit  access  to  personal  information  to  staff  on  a 
“need-to-know”  basis, 

• develop  procedures  for  storage,  retention  and 
destruction  of  personal  information,  and 

• provide  privacy  and  security  training/awareness  for 
employees. 

One  organization  was  also  required  to  obtain  computer 
equipment  to  obscure  credit  card  numbers  printed  on 
receipts  and  return  slips. 

Photocopiers  and  fax  machines  latest  security  risk 

(March  2005) 

The  Office  of  the  Information  and  Privacy  Commissioner 
was  the  first  Commissioner’s  Office  to  alert  the  public 
about  how  the  newer  generation  of  office  equipment 
such  as  digital  photocopiers  and  fax  machines  can  pose 
a security  risk  for  organizations. 

Digital  photocopiers  and  fax  machines  bought  or  leased 
in  recent  years  may  contain  hard  drives  or  memory  chips. 
Like  a computer,  those  hard  drives  and  memoiy  chips  can 
record  and  store  data  that  has  been  photocopied  or  faxed. 


“Increasingly,  office  equipment  has  moved  toward  digital- 
based  technology  producing  office  machines  with  more 
features  and  greater  capability,”  said  Information  and 
Privacy  Commissioner  Frank  Work.  “However,  this  new 
equipment  also  comes  with  some  potential  security  issues 
regarding  how  data  is  handled  and  stored,”  he  added. 

Personal  information,  health  information  and  other 
confidential  business  information  of  an  organization 
stored  on  the  machine’s  hard  drive  can  be  at  risk  for 
unauthorized  access  or  disclosure  when  the  machine 
is  serviced,  returned  at  the  end  of  a lease  or  sold. 
Unauthorized  access  or  disclosure  of  personal  information 
is  a breach  of  provincial  privacy  legislation. 

To  understand  and  guard  against  the  security  risk  posed 
by  digital  photocopying,  fax  machines,  or  multifunction 
devices  (i.e.  copier,  scanner,  printer,  fax  in  one  unit), 
organizations  should  be  aware  of  this  potential  security 
risk,  and  take  appropriate  measures  to  protect  their  data. 
Both  the  organization  which  puts  the  personal  information 
on  the  machine  and  the  vendor  of  the  machine  are 
responsible  for  the  information  on  it. 
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STATEMENT  OF  FINANCIAL  POSITION 
AS  AT  MARCH  31,  2005 


2005 

2004 

ASSETS 

Current  assets 

Cash 

$ 

250 

$ 

250 

Accounts  receivable 

613 

- 

Prepaid  expenses 

25,556 

27,308 

Total  current  assets 

26,419 

27,558 

Tangible  capital  assets  (Note  4) 

320,806 

313,766 

$ 

347,225 

$ 

341,324 

LIABILITIES  AND  NET  LIABILITIES 

Current  liabilities 

Accounts  payable 

$ 

441,627 

$ 

281,307 

Accrued  vacation  pay 

260,406 

232,406 

Total  current  liabilities 

702,033 

513,713 

Net  liabilities 

(354,808) 

(172,389) 

$ 

347,225 

1= 

341,324 

The  accompanying  notes  and  schedule  are  part  of  these  financial  statements. 
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STATEMENT  OF  CHANGES  IN  NET  LIABILITIES 
FOR  THE  YEAR  ENDED  MARCH  31, 2005 


2005  2004 


Net  liabilities  at  beginning  of  year 

$ 

(172,389) 

$ (85,093) 

Net  operating  results 

(3,923,733) 

(3,479,923) 

Net  transfer  from  general  revenues 

3,741,314 

3,392,627 

Net  liabilities  at  end  of  year 

$_ 

(354,808) 

$ (172,389) 

The  accompanying  notes  and  schedule  are  part  of  these  financial  statements. 
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STATEMENT  OF  OPERATIONS 

FOR  THE  YEAR  ENDED  MARCH  31, 2005 

2005  2005  2004 

Budget  Actual  Actual  Restated 

(Note  6) 


Revenues 


Shared  services  - Office  of  the  Ethics  Commissioner 

$ 12,240 

$ 

22,243 

Other  revenue 

333 

398 

Prior  year  expenditure  refund 

136 

779 

Total  Revenue 

12,709 

23,420 

Expenses 

Voted 

Salary,  wages,  and  employee  benefits 

3,324,057 

2,739,168 

Supplies  and  services 

579,361 

703,512 

$ 4,072,000 

3,903,418 

3,442,680 

Non-budgetary 

Capitalization  of  assets  expensed  as  supplies 

(121,882) 

(102,958) 

Amoritization  of  capital  assets 

114,809 

116,987 

Shared  Services  - Office  of  the  Ethics  Commissioner 

12,240 

22,243 

Loss  (Gain)  on  disposal  of  capital  assets 

(143) 

(61) 

5,024 

36,211 

Valuation  adjustment 

Provision  for  vacation  pay 

28,000 

24,452 

Total  Expenses 

3,936,442 

3,503,343 

Net  operating  results 

$ (3,923,733) 

$ 

(3,479,923) 

The  accompanying  notes  and  schedule  are  part  of  these  financial  statements. 
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STATEMENT  OF  CASH  FLOW 

FOR  THE  YEAR  ENDED  MARCH  31,  2005 


2005  2004 


Operating  transactions 

Net  operating  results 

$ (3,923,733) 

$ (3,479,923) 

Non-cash  items  included  in  net  operating  results 

Amortization  of  capital  assets 

114,809 

116,987 

Gain  on  disposal  of  capital  assets 

(143) 

(61) 

(3,809,067) 

(3,362,997) 

(Increase)  decrease  in  accounts  receivable 

(613) 

803 

Decrease  (increase)  in  prepaid  expense 

1,752 

(4,574) 

Increase  in  accounts  payable 

160,320 

52,586 

Increase  in  accrued  vacation  pay 

28,000 

24,452 

Cash  applied  to  operating  transactions 

(3,619,608) 

(3,289,730) 

Capital  transactions 

Disposal  of  capital  assests 

176 

61 

Acquisition  of  capital  assets 

(121,882) 

(102,958) 

Cash  applied  to  capital  transactions 

(121,706) 

(102,897) 

Financing  transactions 

Net  transfer  from  general  revenues 

3,741,314 

3,392,627 

Increase  (decrease)  in  cash 

- 

- 

Cash,  beginning  of  year 

250 

250 

Cash, end  of  year 

$ 250 

$ 250 

The  accompanying  notes  and  schedule  are  part  of  these  financial  statements. 
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NOTES  TO  THE  FINANCIAL  STATEMENTS 
FOR  THE  YEAR  ENDED  MARCH  31,  2005 

Note  1 Authority 

The  Office  of  the  Information  and  Privacy  Commissioner  is  operated  under  the  authority  of  the  Freedom 
of  Information  and  Protection  of  Privacy  Act . The  net  cost  of  the  operations  of  the  Office  is  borne  by  the 
General  Revenue  Fund  of  the  Province  of  Alberta.  Annual  operating  budgets  are  approved  by  the  Select 
Standing  Committee  on  Legislative  Offices. 

Note  2 Purpose 

The  Office  of  the  Information  and  Privacy  Commissioner  administers  the  following  legislation  governing 
access  to  information  and  protection  of  privacy: 

Freedom  of  Information  and  Protection  of  Privacy  Act 

Health  Information  Act 

Personal  Information  Protection  Act 

The  major  operational  purposes  of  the  Office  of  the  Information  and  Privacy  Commissioner  are: 

To  facilitate  the  resolution  of  matters  dealing  with  access  to  information  and  protection  of  personal 
privacy  under  the  three  relevant  Alberta  statutes, 

To  advocate  protection  of  privacy  for  Albertans, 

To  advance  open  and  accountable  government  in  all  Alberta  public  bodies 

Note  3 Summary  of  Significant  Accounting  Policies  and  Reporting  Practices 

These  financial  statements  are  prepared  in  accordance  with  Canadian  generally  accepted 
accounting  principles: 

a)  Reporting  Entity 

The  reporting  entity  is  the  Office  of  the  Information  and  Privacy  Commissioner,  for  which  the 
Information  and  Privacy  Commissioner  is  responsible. 

The  Office  operates  within  the  General  Revenue  Fund.  The  Fund  is  administrated  by  the  Minister  of 
Finance.  All  cash  receipts  of  the  Office  are  deposited  into  the  Fund  and  all  cash  disbursements  made 
by  the  Office  are  paid  from  the  Fund.  Net  transfers  from  general  revenues  is  the  difference  between  all 
cash  receipts  and  all  cash  disbursements  made. 
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b)  Basis  of  Financial  Reporting 
Revenues 

All  revenues  are  reported  on  the  accrual  basis  of  accounting. 

Expenses 

Expenses  represent  the  costs  of  resources  consumed  during  the  year  on  the  Office’s  operations. 

Valuation  Adjustments 

Valuation  adjustments  include  changes  in  the  valuation  allowances  used  to  reflect  financial  assets  and 
liabilities  at  their  net  recoverable  or  other  appropriate  value.  Valuation  adjustments  also  represent  the 
change  in  management’s  estimate  of  future  payments  arising  from  obligations  relating  to  vacation  pay. 

Assets 

Tangible  capital  assets  are  amortized  on  a straight-line  basis,  over  the  estimated  useful  lives  of  the 
assets  as  follows: 

Computer  hardware  and  software  3 years 

Furniture  and  other  office  equipment  10  years 

The  Office  follows  government  budgetaiy  practices  which  allow  funds  from  an  operating  budget  to  be 
used  to  purchase  capital  assets.  These  purchases  are  included  in  expenses  on  the  statement  of  operations, 
but  are  then  removed  from  expenses  through  a non-budgetary  adjustment  and  are  capitalized  and 
amortized  over  their  useful  lives.  Assets  are  capitalized  if  their  useful  life  is  expected  to  be  longer  than 
1 year  and  purchase  price  is  $2,500  or  greater. 

Liabilities 

Liabilities  include  all  financial  claims  payable  by  the  Office  at  fiscal  year  end. 

Net  Liabilities 

Net  liabilities  represent  the  difference  between  the  value  of  assets  held  by  the  Office  and  its  liabilities. 
Valuation  of  Financial  Assets  and  Liabilities 

Fair  value  is  the  amount  of  consideration  agreed  upon  in  an  arm’s  length  transaction  between 
knowledgeable,  willing  parties  who  are  under  no  compulsion  to  act. 

The  fair  values  of  cash,  accounts  receivable,  accounts  payable  and  accrued  vacation  pay  are  estimated  to 
approximate  their  book  values,  due  to  the  short-term  nature  of  these  items. 
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c)  Change  in  Accounting  Policy 

Effective  April  1,  2004,  the  Office  determined  that  the  standards  established  by  the  CICA’s  Public 
Sector  Accounting  Board  were  the  most  appropriate  to  its  objectives  and  circumstances.  Consequently, 
the  Office  no  longer  treats  services  paid  for  by  other  entities  as  expenses  and  contributed  revenue. 

This  treatment  has  been  applied  retroactively  with  restatement  of  the  comparative  financial 
statements.  This  change  has  had  no  effect  on  the  net  cost  of  operations  and  the  net  liabilities  for  the 
current  year  and  the  prior  year. 

Note  4 Tangible  capital  assets 


2005  2004 


Accumulated 

Net  Book 

Net  Book 

Cost 

Amortization 

Value 

Value 

Computer  hardware  and  software 

Furniture  and  other  office  equipment 

$ 

518,480 

330,521 

$ 

392,615 

135,580 

$ 

125,865 

194,941 

$ 

139.883 

173.883 

$ 

849,001 

$ 

528,195 

$ 

320,806 

$ 

313,766 

Note  5 Defined  Benefit  Plans 

The  Office  participates  in  the  multiemployer  pension  plans,  Management  Employees  Pension  Plan  and 
Public  Service  Pension  Plan.  The  Office  also  participates  in  the  multiemployer  Supplementary  Retirement 
Plan  for  Public  Service  Managers.  The  expense  for  these  pension  plans  is  equivalent  to  the  annual 
contributions  of  $288,023  for  the  year  ending  March  31,  2005  (2004  - $240,250). 

At  December  31,  2004,  the  Management  Employees  Pension  Plan  reported  a deficiency  of  $268,101,000 
(2003-$290, 01 4,000)  and  the  Public  Service  Pension  Plan  reported  a deficiency  of  $450,068,000  (2003- 
$584,213,000).  At  December  31,  2004,  the  Supplementaiy  Retirement  Plan  for  Public  Service  Managers 
had  a surplus  of  $9,404,000  (2003-$9,312,000). 

The  Office  also  participates  in  a multiemployer  Long  Term  Disability  Income  Continuance  Plan.  At  March 
31,  2005,  the  Management,  Opted  Out  and  Excluded  Plan  reported  an  actuarial  surplus  of  $3,208,000 
(2004-$  1,298,000).  The  expense  for  this  plan  is  limited  to  employer’s  annual  contributions  for  the  year. 
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Note  6 Budget 

Expenses 

2004-2005  budget'3'  $ 4,072,000 

2004-2005  actual  expenses  (excluding  valuation  adjustments)  3,903,418 

2004-2005  surplus  (excluding  valuation  adjustments)  $ 168,582 

(a)  Legislative  Assembly  Estimates  released  on  March  24,  2004 


Note  7 Lease  Obligations  and  Commitments 

The  Office  leases  certain  equipment  under  operating  leases  that  expire  on  various  dates  to  2008.  The 
aggregate  amount  payable  for  the  unexpired  terms  of  these  leases  are  as  follows: 


2006 

$ 

15,752 

2007 

15,536 

2008 

9,246 

1 

$ 

40,534 

Note  8 


Approval  of  Financial  Statements 

These  financial  statements  were  approved  by  the  Information  and  Privacy  Commissioner. 
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SALARY  AND  BENEFITS  DISCLOSURE 

FOR  THE  YEAR  ENDED  MARCH  31 , 2005  Schedule  1 

2005 2004 

Other 

Other  Cash  Non-Cash 

Base  Salary 01  Benefits1  (2)  Benefits (3)  Total  Total 

Senior  official 

Information  and  Privacy  $ 160,780  $ 5,982  $ 33,930  $ 200,692  $ 198,111 

Commissioner (4) 

(1)  Base  salary  includes  pensionable  contract  base  pay. 

(2)  Other  cash  benefits  include  bonuses,  vacation  payments,  overtime  and  lump  sum  payments 

(3)  Other  non-cash  benefits  include  employer's  share  of  all  employee  benefits  and  contributions  or  payments  made  on  behalf  of  employees 
including  CPP/EI  premiums,  pension,  Alberta  Health  Care,  extended  medical,  prescription  drug  and  dental  coverage,  group  life  insurance, 
long-term  disability  plan,  WCB,  professional  memberships,  tuition  and  learning/wellness  benefit. 

(4)  Automobile  provided,  no  dollar  amount  included  in  other  non-cash  benefits  figures. 


SCHEDULE  OF  ALLOCATED  COSTS 

FOR  THE  YEAR  ENDED  MARCH  31 , 2005  Schedule  2 

2005  2004 


Valuation 


Expenses  - Incurred  by  Others 

Adjustments14’ 

Accommodation 

Telephone 

Vacation 

Total 

Total 

Program 

Operations 

Expenses11’ 

$ 3,908,442 

Costs12’ 

Costs13’ 

Pay 

Expenses 

Expenses 

$ 192,031 

$ 11,851 

$ 28,000 

$ 4,140,324 

$ 3,695,72 

(1)  Expenses  - Directly  Incurred  as  per  Statement  of  Operations,  excluding  valuation  adjustments. 

(2)  Costs  shown  for  Accommodation  (includes  grants  in  lieu  of  taxes)  is  allocated  by  square  footage. 

(3)  Costs  shown  for  Telephone  is  the  line  charge  for  each  telephone  number. 

(4)  Valuation  Adjustments  as  per  Statement  of  Operations.  Employee  benefits  provision  was  allocated  by  employee. 
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Appendix  A:  Cases  Opened  2004-2005  Fiscal  Year  By  Public  Body,  Custodian  and  Organization  Type 

Statistics  are  from  the  period  of  April  1, 2004  to  March  31, 2005 


FOIP  Public  Body  Type 

Request 
for  Review 

Excuse 

Fees 

Complaint 

Privacy  Impact 

Assessments 

Advice  and 
Direction 

Time 

Extension 

Investigation 
Generated  by 
Commissioner 

Authorization 
to  Disregard 
Request 

Other 

TOTAL 

Boards 

4 

1 

10 

1 

0 

0 

1 

0 

1 

18 

Child  and  Family  Service  Authorities 

2 

0 

1 

0 

0 

4 

0 

0 

0 

7 

Colleges 

1 

0 

3 

0 

0 

0 

0 

0 

1 

11 

Crown  Corporation 

0 

0 

0 

1 

0 

0 

0 

0 

0 

1 

Independent  Agency 

1 

0 

1 

0 

1 

0 

1 

0 

1 

5 

Government  Ministries/Departments 

66 

3 

21 

9 

2 

17 

1 

0 

10 

129 

Law  Enforcement  Agencies 

32 

1 

9 

0 

0 

3 

1 

0 

2 

48 

Local  Government  Bodies 

0 

0 

1 

0 

0 

0 

0 

1 

0 

2 

Municipalities 

31 

1 

_j 

1 

0 

0 

0 

2 

2 

44 

Premier's  Office 

0 

1 

0 

0 

0 

1 

0 

0 

0 

2 

Regional  Health  Authorities 

10 

0 

0 

0 

0 

0 

0 

0 

0 

10 

School  Districts 

7 

0 

6 

0 

0 

0 

0 

0 

1 

14 

Universities 

2 

0 

6 

1 

0 

0 

0 

0 

2 

11 

‘Other 

0 

0 

0 

0 

0 

0 

0 

0 

2 

2 

Total 

162 

7 

65 

13 

3 

25 

4 

3 

22 

304 

‘Public  Body  types  identified  as  "Other"  category  include:  Committee,  Commission,  Federal  Department,  Foundation,  Hospital  Board,  Regional  District,  Society,  and  Tribunal. 


HIA  Custodian  Type 

Alberta  Health  and  Wellness 

3 

0 

3 

16 

0 

0 

2 

0 

2 

26 

Custodians  Pursuant  to  the  Regulations 

2 

0 

0 

0 

0 

0 

0 

1 

0 

3 

Long  Term  Care  Facilities 

■1 

0 

0 

3 

0 

0 

1 

0 

1 

6 

Pharmacies/Pharmacists 

1 

0 

1 

3 

0 

0 

1 

0 

2 

8 

Physicians 

14 

0 

6 

148 

0 

0 

9 

2 

3 

182 

Provincial  Boards 

0 

0 

0 

1 

0 

0 

0 

0 

0 

1 

Regional  Health  Authorities 

19 

0 

11 

44 

1 

0 

2 

0 

4 

81 

Subsidiary  Health  Corporation 

0 

0 

0 

2 

0 

0 

0 

0 

0 

2 

‘Other  Custodians 

0 

0 

1 

0 

0 

0 

4 

0 

0 

5 

Total 

40 

0 

22 

217 

1 

0 

19 

3 

12 

314 

‘Custodian  types  identified  as  "Other” category  include:  Community  Health  Councils,  Chiropractors,  Dental  Mechanics,  Dental  Surgeons,  Opticians,  Optometrists,  Osteopaths,  Podiatrists  and  Subsidiary  Health  Corporations. 


PIPA  Organization  Type 

Accommodation  & Food  Services 

1 

0 

3 

0 

0 

0 

0 

0 

0 

4 

Admin  & Support  Services 

6 

0 

6 

0 

0 

0 

1 

0 

0 

13 

Construction 

1 

0 

3 

0 

0 

0 

0 

0 

0 

4 

Educational  Services 

1 

0 

4 

0 

0 

0 

0 

0 

0 

5 

Finance 

0 

0 

6 

0 

0 

0 

1 

0 

0 

7 . 

Healthcare  and  Social  Assistance 

4 

0 

8 

0 

0 

0 

1 

0 

0 

13 

Information  & Cultural  Industries 

1 

0 

3 

0 

0 

0 

1 

0 

0 

5 

Insurance  Industry 

3 

0 

8 

0 

0 

0 

0 

0 

0 

11 

Manufacturing 

2 

0 

2 

0 

0 

0 

0 

0 

0 

4 

Mining,  Oil  &Gas 

3 

0 

15 

0 

0 

0 

0 

0 

0 - 

18 

. Professional,  Scientific  & Technical 

5 

0 

9 

0 

0 

0 

0 

0 

0 

14 

Public  Administration 

0 

0 

2 

0 

0 

0 

0 

0 

0 

2 

Real  Estate 

3 

0 

16 

0 

0 

0 

1 

0 

0 

20 

Retail 

10 

0 

14 

0 

0 

0 

1 

0 

0 

25 

Transportation 

0 

0 

1 

0 

0 

0 

0 

0 

0 

1 

Utilities 

0 

0 

6 

0 

0 

0 

0 

0 

0 

6 

Wholesale  Trade 

1 

0 

6 

0 

0 

0 

0 

0 

0 

7 

‘Other  Services 

13 

0 

16 

0 

0 

0 

0 

0 

0 

29 

Total 

54 

0 

128 

0 

0 

0 

6 

0 

0 

188 

‘Other  Services  include  repair,  personal  care,  beauty  shops,  unions,  parking  lots,  religious  organizations,  business  associations,  political  organizations,  professional  organizations  and  condo  boards. 


AMVIR  Public  Body  Type 

‘Government  Ministries/Departments 

7 

0 

0 

0 

0 

0 

0 

0 

0 

7 

Total 

7 

0 

0 

0 

0 

0 

0 

0 

0 

7 

‘All  cases  with  Alberta  Registries. 

AMVIR  Statistics  are  from  the  time  period  the  Legislation  came  into  force  May  1 2, 2004  to  March  31, 2005. 

“Case  types  identified  in  the  "Other"  category  include:  Requests  for  Information,  Comments  on  Schemes  and  Programs,  Research  Proposal  Agreements,  Data  Sharing  Agreements  and  Non-jurisdictional. 
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Appendix  B:  Cases  Closed  2004-2005  Fiscal  Year  By  Public  Body,  Custodian  and  Organization  Type 

Statistics  are  from  the  period  of  April  1, 2004  to  March  31, 2005 


FOIP  Public  Body  Type 

Request 
for  Review 

Excuse 

Fees 

Complaint 

Privacy  Impact 
Assessments 

Advice  and 
Direction 

Time 

Extension 

Investigation 
Generated  by 
Commissioner 

Authorization 
to  Disregard 
Request 

Other 

TOTAL 

Boards 

10 

1 

6 

1 

0 

0 

1 

0 

1 

20 

Child  and  Family  Service  Authorities 

3 

0 

2 

0 

0 

4 

0 

1 

0 ' 

10. 

Colleges 

5 

0 

2 

0 

0 

0 

0 

0 

0 

7 

Crown  Corporation 

0 

0 

0 

1 

0 

0 

0 

0 

o 

1 

Government  Ministries/Departments 

56 

3 

16 

9 

1 

14 

1 

1 

8 

109 

Independent  Agency 

0 

0 

1 

0 

1 

0 

0 

0 

2 

4 

Law  Enforcement  Agencies 

31 

4 

1 

0 

0 

3 

0 

0 

1 

40 

Local  Government  Bodies 

0 

0 

0 

0 

0 

0 

0 

2 

0 

2 

Municipalities 

24 

1 

8 

0 

0 

0 

0 

2 

1 

36 

Premier's  Office 

0 

2 

0 

I o,  .- 

0 

1 

0 

0 

0 

3 

Regional  Health  Authorities 

5 

0 

1 

0 

0 

0 

0 

0 

1 

8 

School  Districts 

4 

0 

7 

• 0 

0 

0 

0 

0 

1 

12 

Universities 

6 

0 

1 

0 

0 

0. 

0 

0 

2 

9 

‘Other 

0 

0 

0 

0 

0 

0 

0 

0 

2 

2 

Total 

144 

11 

46 

11 

2 

22 

2 

6 

19 

263 

‘Public  Body  types  identified  as  "Other"  category  include:  Committees,  Commissions,  Federal  Departments,  Foundations,  Hospital  Boards,  Regional  Districts,  Societies,  and  Tribunals. 


HIA  Custodian  Type 

Alberta  Health  and  Wellness 

2 

0 

0 

13 

0 

0 

1 

0 

2 

18 

Custodians  Pursuant  to  the  Regulations 

2 

0 

0 

0 

0 

0 

0 

1 

0 

3 

Long  Term  Care  Facilities 

0 

0 

0 

2 

0 

0 

2 

0 

1 

5 

Pharmacies/Pharmacists 

0 

0 

1 

1 

00 

0 

2 

4 

Physicians 

15 

0 

7 

149 

0 

0 

9 

2 

3 

185 

Provincial  Boards 

0 

0 

0 

2 

0 

0 

0, 

0 

0 

2 

Regional  Health  Authorities 

16 

0 

3 

44 

1 

0 

3 

0 

4 

71 

Subsidiary  Health  Corporation 

0 

0 

1 

2 

0 

0 

1 

0 

| 0 

mi 

‘Other  Custodians 

0 

0 

1 

1 

0 

0 

5 

o 

0 

7 

Total 

35 

0 

13 

214 

1 

0 

21 

3 

12 

299 

‘Custodian  types  identified  as  "Other"  category  include:  Community  Health  Councils,  Chiropractors,  Dental  Mechanics,  Dental  Surgeons,  Opticians,  Optometrists,  Osteopaths,  Podiatrists  and  Subsidiary  Health  Corporations. 


PIPA  Organization  Type 

Accommodation  & Food  Services 

1 

0 

2 

0 

0 

0 

0 

0 

0 

3 

Admin  & Support  Services 

4 

0 

3 

0 

0 

0 

1 

0 

.0 

8 

Construction 

1 

0 

0 

0 

0 

0 

0 

0 

0 

1 

Educational  Services 

1 

0 

4 

0 

0 

0 

1 

0 

0 

6 

Finance 

0 

0 

2 

0 

0 

0 

0 

0 

0 

2 

Healthcare  & Social  Assistance 

5 

0 

6 

0 

0 

0 

0 

0 

0 

11 

Information  & Cultural  Industries 

0 

0 

2 

0 

0 

0 

1 

0 

0 

3 

Insurance  Industry 

2 

0 

5 

0 

H9I 

0 

b 

0 - 

0 

7 

Manufacturing 

1 

0 

3 

0 

0 

0 

0 

0 

0 

4 

Mining,  Oil  & Gas 

2 

0 

4 

0 

0 

0 

0 

0 

0 

6 

Professional,  Scientific  &Tech. 

1 

0 

4 

0 

0 

0 

0 

0 

0 

5 

Public  Administration 

0 

0 

1 

0 

0 

0 

0 

0 

0 

1 

Real  Estate,  Rental  & Leasing 

2 

| 

9 

0 

0 

0 

0 

0 

0 

11 

Retail 

7 

0 

6 

0 

0 

0 

0 

0 

0 

13 

Transportation 

0 

0 

3 

0 

0 

o' 

0 

0 

0 

3 

Utilities 

0 

0 

5 

0 

0 

0 

0 

0 

0 

5 

Wholesale  Trade 

1 

0 

4 

0 

0 

0 

0 

0 

o. 

5 ' 

‘Other  Services 

7 

0 

6 

0 

•0 

0 

0 

0 

0 

13 

Total 

35 

0 

69 

0 

0 

0 

3 

0 

0 

107 

‘Other  Services  include:  repair,  personal  care,  beauty  shop,  unions,  parking  lots,  religious  organizations,  business  associations,  political  organizations,  professional  organizations,  condo  boards. 


AMVIR  Public  Body  Type 

‘Government  Ministries/Departments 

2 

0 

0 

0 

0 

0 

0 

0 

1 

3 

Total 

1 

0 

0 

0 

0 

0 

0 

0 

2 

3 

‘All  cases  with  Alberta  Registries. 

AMVIR  Statistics  are  from  the  time  period  the  Legislation  came  into  force  May  1 2, 2004  to  March  31 , 2005. 

“Case  types  identified  in  the  "Other"  category  include:  Requests  for  Information,  Comments  on  Schemes  and  Programs,  Research  Proposal  Agreements,  Data  Sharing  Agreements  and  Non-jurisdictional. 
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Appendix  C:  Orders  and  Public  Investigation  Reports  Issued 

All  Statistics  are  from  the  period  April  1, 2004  to  March  31, 2005 


FOIP  Public  Body 

Orders 

Public  Investigation 
Reports 

TOTAL 

Alberta  Environment 

1 

0 

1 

Alberta  Innovation  and  Science 

1 

0 

1 

’Alberta  Justice 

1 

0 

1 

’Alberta  Learning 

1 

0 

1 

Alberta  Solicitor  General 

0 

2 

2 

*Calgary  Police  Service 

3 

0 

3 

City  of  Calgary 

2 

0 

2 

Conseil  Scolaire  Catholique  et  Francophone  du  Sud 

0 

1 

1 

Edmonton  Police  Service 

1 

0 

1 

Edmonton  Public  School  Board  District  No.  7 

1 

0 

1 

Executive  Council 

1 

0 

1 

Grant  MacEwan  College 

1 

0 

1 

Lethbridge  Police  Service 

1 

0 

1 

’Medicine  Hat  Police  Service 

1 

0 

1 

Mount  Royal  College 

1 

0 

1 

Northern  Alberta  Institute  ofTechnology  (NAIT) 

0 

1 

1 

Personnel  Administration  Office 

0 

2 

2 

University  of  Alberta 

1 

0 

1 

University  of  Calgary 

1 

0 

1 

’Workers' Compensation  Board 

2 

0 

2 

Subtotal 

20 

6 

26 

HIA  Custodian 

Dr.  Morage  E.  Goldie 

1 

0 

1 

Dr.  Salma  B.  Murji 

1 

0 

1 

Misdirected  Faxes 

0 

1 

1 

Sub-total 

2 

1 

3 

PIPA  Organization 

Digital  Communications  Group  Inc. 

0 

1 

1 

EPCOR 

0 

1 

1 

Linens 'N  Things 

0 

1 

1 

Nor-Don  Collection  Network  Inc. 

0 

1 

1 

Melrose  Rural  Electrification  Association,  ATCO  Electric  & Direct  Energy  Marketing  Limited 

0 

1 

1 

Subtotal 

0 

5 

5 

AMVIR  Public  Body 

N/A 

1 

0 

1 

Sub-total 

1 

0 

1 

Total  23  12  35 


AMVIR  Statistics  are  from  the  time  period  the  Legislation  came  into  force  May  12, 2004  to  March  31, 2005. 

FOIP  Orders:  20  (total  of  27  cases) 

HIA  Orders:  2 (total  of  3 cases)] 

Note:  Some  Orders  and/or  Report  Numbers  were  assigned  to  more  than  one  case. 

Note:  Orders  are  recorded  by  the  date  the  Order  was  signed,  rather  than  the  date  the  Order  was  publicly  released. 

Note:  ’Under  the  legislation,  only  certain  case  types  can  proceed  to  inquiry  if  the  matters  are  not  resolved  at  mediation/investigation.  The  above  statistics  are  those  case  types  that 
can  proceed  to  inquiry  (Request  for  Review  and  Complaint  files). 

Please  refer  to  Tables  1 and  2 and  Appendices  A and  B for  total  cases  opened  and  closed. 

A copy  of  all  Orders  and  Investigation  Reports  are  available  on  the  Office's  web  site  www.oipc.ab.ca 
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Appendix  D:  Accepted  Privacy  Impact  Assessments  by  Public  Body  and  Custodian  Type:  2004  - 2005 

All  statistics  are  for  the  period  of  April  1, 2004-  March  31, 2005 


Public  Body 

PIA  Title 

Date  Accepted 

Boards 

Provincial  Persons  with  Developmental 
Disabilities  Board 

Addition  of  Abuse  Prevention  and  Response  Protocol  Data  Tracking  System  Module  • 

Jul/7/2004 

Ministry/Department 

Advanced  Education 

Alberta  Centennial  Education  Savings  Plan 

Jan/4/2005 

Alberta  Children's  Services 

Children  and  Youth  with  Complex  NeedsTracking  System 

May/272004 

Family  Support  for  Children  with  Disabilities  Information  System  (FSCDIS) 

Dec/8/2004 

Alberta  Government  Services 

Internet  Fines  Payment  System 

Ju 1/30/2004 

SPIN  2 (Phase  2)  Intelligent  Documents  Project 

Jan/7/2005 

Alberta  Human  Resources  and  Employment 

Income  Verification  Information  Exchange  Program 

Nov/23/2004 

Alberta  Learning 

Pilot  Project  on  Priority  Processing  of  International  Students  to  Designated  Alberta 

Post-Secondary  institutions 

Oct/27/2004 

Alberta  Justice 

Maintenance  Enforcement  Program  - Help  Lis  Find  Web  Site 

Nov/4/2004 

Other 

Alberta  Research  Council 

Office  of  the  Corporat§.Chief 

Information  Officer 

Security  Screening  Directive  for  the  Alberta  Research  Council 

Ju  1/26/2004 

Government  of  Alberta  Information  and  CommunicationsTechnology  (ICT)  Operations 

Jul/1 6/2004 

Custodian 

PIA  Title 

Date  Accepted 

Regional  Health  Authorities  (RHA) 

Aspen  Regional  Health  Authority 

Organizational  Privacy  PIA 

Dec/8/2004 

Calgary  Health  Region 

Calgary  Health  Link  Addendum 

Sep/1 /2004 

CHR  Human  Resources  Management  System  (H.RMS)  Strategic  Partner  Solution 

0ct/20/2004 

Eating  Disorder  Program  Database 

Apr/22/2004 

EMS  - (ECG)  MUSE  Repository 

Feb/10/2005 

HIA  Electronic  Delivery  of  Laboratory  Results 

Oct/25/2004 

Laboratory  Clinical  Data  Repository  (LCDR) 

Jan/19/2005 

Operative  Services  Information  System  (OSIS) 

Apr/16/2004 

Phase  1 Chronic  Disease  Management  Information  System  (CDMIS) 

Jul/27/2004 

Picture  Archiving  & Communication  System 

Sep/21 >2004 

Pharmacy  System  Replacement 

Feb/23/2005 

Southern  Alberta  Renal  Program  Database 

Jan/14/2005 

Capital  Health 

Capital  Health  Link  Expansion 

Sep/27/2004 

Capital  Health's  Organizational  Privacy  Management  (Part  A)"  Amendment 

Jan/4/2005 

CBORD  Nutrition  Services  Suite  - Royal  Alexandra  Hospital  and  Glenrose  Rehabilitation  Hospital 

Diet  Automation 

Aug/10/2004 

Community  Care  Client  Concerns  Database 

Jan/6/2005 

EndoWorks  Image  Manager  Pilot  Project  - RAH 

Dec/1 7/2004 

Integrated  Public  Health  Information  System  -TB  Case  Management 

Jan/1 7/2005 

NetCARE  (Electronic  Health  Record  Clinical  Portal) 

Jul/30/2004 

NetCare  (Electronic  Health  Record  Clinical  Portal)  Amendment  #1 

Dec/3 1/2004 

Pixalere  Internet-Based  Wound  Management  System 

Sep/17/2004 

Regional  Palliative  Care  Program  Database 

Jul/30/2004 

Strata  Health  Path  Ways  Waitlist  Management  Project 

Apr/15/2004 

Urgent  Care  Line  (UCL) 

Sep/27/2004 

Virtual  Asthma  Clinic  - Internet  Based  Asthma  Management  Program 

Feb/1 0/2005 

David  Thompson  Health  Region 

AppointmentPro  Scheduling  System 

Aug/10/2004 

Laboratory  Data  Delivery  to  Physician  Office  Systems 

Oct/5/2004 

Telehealth 

Oct/1 9/2004 

Nurse/Physician  Collaborative  Partnership 

Apr/14/2004 

Organizational  Privacy  Management  Privacy  Impact  Assessment 

Nov/30/2004  - 

Public  Health  Information  System  (PHIS) 

Jul/30/2004 

Transcription  Telecommuting 

Nov/30/2004 

East  Central  Health 

East  Central  Health's  Organizational  Privacy  Management  (Part  A) 

Jan/20/2005 

Northern  Lights  Health  Region 

Holter  Monitoring 

Jul/7/2004 

Organizational  Privacy  PIA 

Oct/ 15/2004 

Palliser  Health  Region 

Addendum  for  the  New  Information  Systems  Project 

Mar/16/2005 

Adverse  Event  Management  Systems  (AEMS) 

Jan/6/2005 

PHR  Continuum  Solutions  Discharge  Planning  System 

Aug/6/2004 

Picture  Archival  and  Communication  System  (PACS) 

Dec/23/2004 
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Custodian 

PI  A Title 

Date  Accepted 

Physicians 

Bonaventure  Medical  Clinic 

Physician  Office  System 

Apr/14/2004 

Lynnwood  Clinic 

Physician  Office  System 

Ju 1/20/2004 

Drs.  Olsen,  Hastings  & Evans 

Physician  Office  System 

Nov/30/2004 

Pembina  Medical  Clinic 

Physician  Office  System 

Dec/2 1/2004 

Dr.  James  R.  Adams  PC 

Physician  Office  System 

Oct/2 1/2004 

Dr.  A.  McDonald 

Physician  Office  System 

0ct/20/2004 

| Dr.  Bradley  Stewart 

Physician  Office  System 

Oct/25/2004 

Dr.  Robert  W.  Bradstock 

Physician  Office  System 

Oct/25/2004 

Dr.  Steven  M.  Edworthy  U of  C 

Physician  Office  System 

Apr/15/2004 

Vulcan  Medical  Clinic 

Physician  Office  System 

Apr/7/2004 

Valley  Medical  Clinic 

Physician  Office  System- 

Sep/24/2004 

Garneau  Lung  Laboratory  Inc. 

Physician  Office  System 

Jun/1 5/2004 

Oliver  Eye  Centre 

Physician  Office  System 

May/7/2004 

Calgary  Women's  Imaging  Centre 

Physician  Office  System 

Apr/14/2004 

Cottage  Medical  Clinic 

Physician  Office  System 

0ct/20/2004 

Bonnyville  Medical  Clinic 

Physician  Office  System 

Jul/1 9/2004 

Dr.  David  Cenaiko  PC 

Physician  Office  System 

Sep/1 3/2004 

Bow  River  Medical  Clinic 

Physician  Office  System 

Apr/22/2004 

Dr.  A.  Voth  & Dr.  R.  Chea 

Physician  Office  System 

Sep/14/2004 

Meridian  Medial  Clinic 

Physician  Office  System 

Sep/13/2004 

Dr.  Francois  Malan  PC 

Physician  Office  System 

Ju 1/30/2004 

Dr.  John  P.  McKaigney  - U of  A 

Physician  Office  System 

0ct/20/2004 

Dr.  Martin  C.  Harvey  PC 

Physician  Office  System 

Apr/23/2004 

Orthopedic  Associates 

Physician  Office  System 

Apr/1 /2004 

University  Health  Centre 

Physician  Office  System 

Apr/2 1/2004 

Behm  Clinic 

Physician  Office  System 

Apr/2/2004 

Westview  Medical  Office 

Physician  Office  System 

Ju  1/6/2004 

CUPS  Community  Health  Centre 

Physician  Office  System 

Jun/2/2004 

The  Medical  Centre 

Physician  Office  System 

Apr/21  /2004 

Radiology  Associates  Inc. 

Physician  Office  System 

Apr/2/2004 

Dr.Tewodros  Mequanent 

Physician  Office  System 

May/26/2004 

Dr.  Anthony  S.  K.  Chiu 

Physician  Office  System 

Apr/23/2004 

Drumheller  Associated  Physicians 

Physician  Office  System 

Sep/24/2004 

Alpine  Medical  Clinic 

Physician  Office  System 

Jul/30/2004 

Dr.  Janis  P.  Campbell  PC 

Physician  Office  System 

Nov/22/2004 

Dr.  Tom  Y.  Woo  PC 

Physician  Office  System 

Nov/19/2004 

Storwick  Dermatology  - Laser  Clinic 

Physician  Office  System 

Apr/23/2004 

Mdoc  - Bonavista  Medical  Centre 

Physician  Office  System 

Jun/1 6/2004 

Wild  Rose  Medical  Centre 

Physician  Office  System 

Sep/1 7/2004 

Impact  Health  Services 

Physician  Office  System 

J un/4/2004 

Dr.  Joel  D.  Steed  PC 

Physician  Office  System 

0ct/20/2004 

Dr.  Magnus  Murphy  PC 

Physician  Office  System 

Apr/23/2004 

Alberta  Retina  Consultants 

Teleophthalmology  Services 

Oct/18/2004 

Alberta  Retina  Consultants 

Physician  Office  System 

Dec/1 3/2004 

Sylvan  Lake  Medical  Clinic 

Physician  Office  System 

Apr/13/2004 

Oyen  Medical  Clinic 

Physician  Office  System 

Feb/25/2005 

Family  Medical  Centre 

Physician  Office  System 

Dec/2 1/2004 

High  Level  Medical  Clinic 

Physician  Office  System 

Apr/1 3/2004 

Dr.  D.  Burger  Clinic 

Physician  Office  System 

May/3/2004 

Dr.  Toni  R.  Winder  PC 

Physician  Office  System 

Nov/9/2004 

Pleasantview  Medical  Clinic 

Physician  Office  System 

Ju 1/7/2004 

Dr.  Kelly  Diane  Dabbs 

Physician  Office  System 

Apr/29/2004 

Dr.  Robert  H.  Brown 

Physician  Office  System 

Jun/2/2004 

Grove  Plaza  Medical  Centre 

Physician  Office  System 

May/10/2004 

Meadowbrook  Medical  Clinic 

Physician  Office  System 

May/19/2004 

Drs.  May,  Yemen  & Associates 

Physician  Office  System 

Oct/2 1/2004 

Grandin  Medical  Clinic 

Physician  Office  System 

Feb/28/2005 

Cold  Lake  Health  Centre 

Physician  Office  System 

Ju 1/7/2004 

Allied  Site  Airdire  Medical  Clinic 

Physician  Office  System 

Nov/1 9/2004 

Allied  Site  Airdire  Medical  Clinic 

Physician  Office  System 

Nov/19/2004 
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UCMC  Sunridge  Medical  Clinic 

Physician  Office  System 

Nov/1 9/2004 

Crowfoot  Village  Family  Practice 

Physician  Office  System 

Ju 1/27/2004 

Dr.  Garth  Campbell 

Physician  Office  System 

Aug/3 1/2004 

Crowsnest  Medical  Clinic 

Physician  Office  System 

Dec/13/2004 

Canmore  Medical  Clinic  & Laser  Clinic 

Physician  Office  System 

Jun/1 0/2004  | 

Properties  Medical  Clinic 

Physician  Office  System 

Jun/1 6/2004 

Hanna  Medical  Clinic 

Physician  Office  System 

Jun/1 6/2004 

Dr.  Stuart  A.  Ross 

Physician  Office  System 

' Nov/i  9/2004 

Integrative  Medicine  Institute  of  Canada 

Physician  Office  System 

Jun/23/2004 

Central  Alberta  Medical  Imagining  Services  Ltd. 

Physician  Office  System 

Aug/3 1/2004 

Dr.  Duncan  McCubbin 

Physician  Office  System: 

Sep/24/2004 

Associated  Medical  Clinic  - St.  Paul 

Physician  Office  System  . 

Aug/3 1/2004 

Dr.  Diana  Wong  PC 

Physician  Office  System 

0ct/20/2004 

Sylvan  Family  Health  Centre 

Physician  Office  System 

Jan/14/2005 

Ermineskin  Medical  Clinic 

Physician  Office  System 

0ct/20/2004 

Brentwood  Medical  Walk-In  Clinic 

Physician  Office  System 

Jan/14/2005 

Downtown  Medical  Clinic 

Physician  Office  System 

Jan/1 7/2005 

Medical  Clinic  Inglewood 

Physician  Office  System 

0ct/20/2004 

Towers  Medical  Associates 

Physician  Office  System 

Sep/14/2004 

Dr.  Su-Chong  Lim 

Physician  Office  System 

Oct/2 1/2004 

U of  A - Family  Medicine  Clinic 

Physician  Office  System 

Ju  1/27/2004 

Valley  Ridge  Family  Physicians 

Physician  Office  System 

Ju  1/28/2004 

Centre  for  Sleep  & Human  Performance 

Physician  Office  System 

Sep/13/2004 

Hillcrest  Medical  Associates 

Physician  Office  System 

Ju  1/28/2004 

TJ.  Medical  Associates 

Physician  Office  System 

0ct/20/2004 

Terra  Losa  Medical  Clinic 

Physician  Office  System 

Sep/23/2004 

General  & Laparoscopic  Surgery 

Physician  Office  System 

Feb/1 0/2005 

Aurora  Medical  Clinic 

Physician  Office  System 

Ju 1/28/2004 

17th  Avenue  Southeast  Medical  Centre 

Physician  Office  System 

Aug/30/2004 

Dr.  Hamza  N.  Khan  Medical  Clinic 

Physician  Office  System 

■iN:0v/24/2OO4 

Dr.  Donald  B.  Davis  PC 

Physician  Office  System 

0ct/20/2004 

C-era  Medical  Clinic 

Physician  Office  System 

Nov/19/2004 

Simons  Valley  Family  Clinic 

Physician  Office  System 

Sep/14/2004 

Parkland  Medical  Associates 

Physician  Office  System 

Feb/7/2005 

Fort  Medical  Clinic 

Physician  Office  System 

Mar/3 1/2005 1 

Dr.  Jerry  Pelletier  PC 

Physician  Office  System 

0ct/20/2004  ■ 

South  Shore  Medical  Centre 

Physician  Office  System 

Sep/1 7/2004 

Dr.  Albert  Rosengartep,  Obstetrics  & 
Gynecology  Surgery 

Physician  Office  System 

Mar/10/2005 

Crescent  Heights  Medical  Clinic 

Physician  Office  System 

Sep/23/2004 

Family  Medicine  Clinic 

Physician  Office  System 

1 Feb/22/2005 

Palisades  Medical  Clinic 

Physician  Office  System 

Sep/27/2004 

Dr.  Shawkat  S.  Michel 

Physician  Office  System 

Nov/1 9/2004 

PAEDS  Clinic 

Physician  Office  System 

Dec/13/2004 

Critical  Cate  Clinic 

Physician  Office  System 

Feb/2/2005 

Centre  for  Preventive  Medicine 

Physician  Office  System 

Jan/1 7/2005 

Surgicorp  Inc. 

Physician  Office  System 

Feb/1 /2005 

Dr.  Thomas  Mohanraj 

Physician  Office  System 

Nov/1 /2004 

Mission  Medical  Clinic 

Physician  Office  System 

Nov/1 /2004 

Nottingham  Medical  Clinic  & Weight 
Management  Clinic 

Physician  Office  System 

Nov/2/2004 

Associated  Medical  Clinic  - Airdrie 

Physician  Office  System 

Dec/8/2004 

Dr.  Carolyn  M.B.  Skov  PC 

Physician  Office  System 

Jan/4/2005 

Dr.  Stephen  Genuis 

Physician  Office  System 

Nov/19/2004 

Dr.  Owen  Yuen  & Dr.  Elisabeth  Woolner 

Physician  Office  System 

Jan/24/2005 

Associate  Clinic  - High  Prairie 

Physician  Office  System 

Dec/3/2004 

Dr.  Walter  K.  Gjosund 

Physician  Office  System 

Dec/22/2004 

Northern  Lung  Function  Ltd. 

Physician  Office  System 

Jan/4/2005 

Yellowbird  Family  Clinic 

Physician  Office  System 

Jan/1 1/2005 

Laupland  PC  & Associates 

Physician  Office  System 

Jan/1 7/2005 
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Walk-In  Medical  Clinic 

Physician  Office  System 

Jan/14/2005 

Dr.  E.  Harris 

Physician  Office  System 

Dec/1 5/2004 

Dr.  Jorge  Mayo  PC 

Physician  Office  System 

Jan/24/2005 

Dr.  John  Edward  Holland 

Physician  Office  System 

Dec/15/2004 

Dr.  Bruce  W.Jespersen  PC 

Physician  Office  System 

Feb/1 /2005 

Dr.  Eric  ScNosjf- 

Physician  Office  System' 

Jan/21/2005 

Dr.  E.M.  Squires 

Physician  Office  System 

Feb/22/2005 

Dr.  Eoin  A Lalor 

Physician  Office  System 

Feb/23/2005 

Dr.  Pat  Connick 

Physician  Office  System 

Feb/23/2005 

Dr.  Ronald  Ray  Anderson 

Physician  Office  System 

Feb/25/2005 

Wainwright  Clinic 

Physician  Office  System 

Feb/23/2005 

Drs.  Edgar,  Marriott,  Blaney  & Khatter 

Physician  Office  System 

Feb/1 1/2005 

Claresholm  Medical  Centre 

Physician  Office  System 

Jan/17/2005 

Dr,  Amelia  Correia  Medical  Clinic 

Physician  Office  System 

Mar/10/2005 

Family  Medicine 

Physician  Office  System 

Feb/22/2005 

Dr.  William  R.S.  Halliday 

Physician  Office  System 

Feb/1 1/2005 

Rimbey  Medical  Clinic 

Physician  Office  System 

Mar/9/2005 

Dr.  Gregory  A.  Abelseth 

Physician  Office  System 

Mar/15/2005 

Weinlos  Clinic 

Physician  Office  System 

Mar/30/2005  | 

Dr.  John  P.  Arlette 

Physician  Office  System 

Mar/16/2005 

Dr.  John  R.  Hunter  and  Dr.  David  P.  Miller 

Physician  Office  System 

Mar/2 1/2005 

Killam  Medical  Practice 

Physician  Office  System 

Mar/30/2005 

Dr.  Paul  L.  Martyn 

Physician  Office  System 

Mar/3 1/2005 

Hawkwood  Village  Medical  Clinic 

Physician  Office  System 

Mar/3 1/2005 

Provincial  Boards 

Alberta  Cancer  Board 

New  Provincial  Dictation  System 

Apr/6/2004 

Radiology  Information  System  (RIS) 

Mar/10/2005 

Supplemental  Information  to  the  Cervical  Cancer  Screening  (CCS)  Application 

May/2 1/2004 

Alberta  Mental  Health  Board 

Children's  Mental  Health  Wait  Time  Pilot  Project  - Data  Collection 

Apr/29/2004 

Ministry 

Alberta  Health  and  Wellness 

TB  Case  Management 

Dec/13/2004 

Alberta  Ambulance  Information  Management  System  (AAIMS) 

Mar/10/2005 

Program  Enrolment  and  Services  (PES)  Project 

Jan/1 1/2005 

Second  Addendum  to  the  Provincial  Personal  Health  Identifier/  Person  Directory 

Jan/12/2005 

Business  Intelligence  Environment  (BIE) 

Nov/22/2004 

Laboratory  Clinical  Data  Repository  (LCDR) 

Jan/19/2005 

Wellnet  Application  Implementation  Database 

Apr/16/2004 

Mobile  Diabetes  Screening  Initiative  (MDSI) 

Mar/10/2005 

STD  Case  Management  PIA  Amendment 

Sep/13/2004 

Fine  Needle  Aspiration  Biopsy  (FNAB) 

Feb/8/2005 

Primary  Care  Initiative  and  the  Primary  Care  Claims  Assessment  (CLASS)  Enhancement  Project 

Dec/15/2004 

Alberta  Provider  Directory  (ABPD)  1 st  Addendum 

Feb/8/2005 

Contracted  Mental  Health  Services  - Minimum  Dataset  (CMHS-MD)  Project 

Mar/23/2005 

Subsidiary 

Calgary  Laboratory  Services 

Laboratory  Clinical  Data  Repository  (LCDR) 

Jan/19/2005 

Carewest 

Pharmacy  System  Replacement 

Feb/23/2005 

Physician  Office  System  Program 

POSP,  Phase  2 

Jan/1 /2005 

Pharmacy 

Westfair  Foods  Ltd. 

Prescription  Claims  Adjudication  Through  the  BCE  Emergis  Electronic  Business  Network  (BEBN) 

Nov/16/2004 

Operation  of  a Nursing  Home  or 
Hospital  Not  Owned  by  a RHA 

Caritas  Health  Group 

Child  Health  Clinic  Computer-Based  fully  interactive  audio/visual  therapeutic  equipment 

Ju  1/9/2004 

The  Good  Samaritan  Society 

Senior  Health  Centre 

J un/28/04 

Privacy  Impact  Assessments  are  mandatory  under  the  Health  Information  Act  (HI A),  they  are  not  required  under  the  Freedom  of  Information  and  Protection  of  Privacy  Act 
(FOIP),  the  Personal  Information  Protection  Act  (PIPA)  or  the  Access  to  Motor  Vehicle  Information  Regulation  (AMVIR). 

For  additional  information  regarding  the  above  listed  PIAs,  please  refer  to  the  OIPC  webpage  at  www.oipc.ab.ca 
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